CVE-2026-96428 in Agentflow
Summary
by MITRE • 09/29/2026
SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands via the words parameter.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as a SQL Injection flaw within the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow versions prior to August 8, 2025, represents a critical security deficiency in how user-supplied input is processed by the backend database engine. This specific component handles autocomplete functionality for agenda-related data, which typically involves querying large datasets based on partial string matches provided by the end-user interface. The core technical flaw lies in the improper neutralization of special elements used in SQL commands within the words parameter. Instead of employing prepared statements with parameterized queries or strictly validating and escaping input characters, the application directly concatenates user-supplied data into dynamic SQL strings. This architectural oversight allows an attacker to inject malicious SQL syntax that alters the intended logic of the database query, effectively bypassing authentication controls or extracting sensitive information stored within the underlying relational database management system.
From a technical perspective, this vulnerability aligns with Common Weakness Enumeration identifier CWE-89, which classifies improper neutralization of special elements used in an SQL command. The attack vector is remote and requires no prior authentication if the endpoint is publicly accessible or if session validation is insufficiently enforced on this specific API path. An attacker can craft a specially formatted request where the words parameter contains standard SQL termination sequences followed by malicious commands such as UNION SELECT statements to extract data from other tables, or boolean-based blind injection techniques to infer database structure and content character by character. The impact of successful exploitation extends beyond simple data theft; it potentially allows for full system compromise if the database service account possesses elevated privileges that permit operating system command execution through features like xp_cmdshell in Microsoft SQL Server or similar extensions in other database platforms.
The operational impact of this vulnerability is severe, as Agentflow applications often manage critical business workflows and sensitive organizational data. Successful exploitation could lead to unauthorized disclosure of confidential information including customer details, internal communications, and proprietary process configurations stored within the agenda system. Furthermore, attackers may modify or delete existing records, leading to integrity violations that disrupt business operations and compromise trust in the application's reliability. In worst-case scenarios, the ability to execute arbitrary commands on the database server can serve as a pivot point for lateral movement into other parts of the internal network, escalating the threat from data exposure to complete infrastructure takeover. This aligns with MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter if command execution is achieved, or T1005 Data from Local System combined with T1213 Data from Information Repositories for exfiltration activities.
Mitigation strategies must prioritize immediate remediation of the codebase responsible for handling the autocomplete requests. The primary fix involves refactoring the SQL query construction to use parameterized queries or prepared statements, which ensure that user input is treated strictly as data rather than executable code. Additionally, implementing strict input validation on the words parameter by whitelisting allowed characters and rejecting any input containing SQL metacharacters such as single quotes, semicolons, or comment markers can provide a defense-in-depth layer. Network-level controls should also be reviewed to restrict access to this API endpoint only from trusted IP ranges if it does not require public accessibility. For organizations unable to immediately patch the software due to dependency constraints, deploying a Web Application Firewall with rules specifically tuned to detect SQL injection patterns in autocomplete parameters can offer temporary protection against active exploitation attempts until the vendor's updated version is deployed and tested in production environments.