| शीर्षक | iFlytek astron-agent 1.0.7 SQL Injection |
|---|
| विवरण | astron-agent 1.0.7 contains a blind SQL injection vulnerability in the getBotList API endpoint.
The affected endpoint is GET /publish/bots. Any authenticated user with a valid JWT can access this endpoint. The
request parameter sortDirection is copied into the bot query condition without validation and is later interpolated
into the SQL ORDER BY clause through MyBatis ${} string substitution in ChatBotMarketMapper.xml.
When sortField is set to createTime or updateTime, the sortDirection value is appended directly after a.create_time or
a.update_time. Because the value is not restricted to ASC or DESC, an attacker can inject arbitrary SQL fragments into
the ORDER BY clause.
A proof-of-concept time-based blind SQL injection payload is:
GET /publish/bots?page=1&size=1&sortField=updateTime&sortDirection=DESC,IF(SUBSTRING(database(),1,1)='a',SLEEP(5),0)--
HTTP/1.1
Authorization: Bearer <valid_jwt>
The issue can be used by a low-privileged authenticated user to perform boolean-based or time-based blind SQL
injection and enumerate database metadata or sensitive business data.
The vulnerability was reported publicly in GitHub issue #1329 on May 16, 2026. The vendor project addressed the issue
in pull request #1342, merged on May 19, 2026, by sanitizing the bot list sort direction. |
|---|
| स्रोत | ⚠️ https://github.com/iflytek/astron-agent/issues/1329 |
|---|
| उपयोगकर्ता | T-Chachamaru (UID 99844) |
|---|
| सबमिशन | 30/08/2026 10:17 AM (24 दिन पहले) |
|---|
| संयम | 22/09/2026 07:23 PM (23 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 408551 [iFlytek astron-agent तक 1.0.7 getBotList API endpoint ChatBotMarketMapper.xml sortDirection SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|