A critical SQL injection vulnerability in Rolantis Agentis permits unauthorized database access and potential remote code execution.

This is an Improper Neutralization of Special Elements used in an SQL Command (CWE-89) vulnerability. The application fails to properly sanitize user inputs, allowing unauthenticated attackers to manipulate database queries.

A CVSS score of 10.0 reflects the maximum severity, indicating that this vulnerability allows for total system compromise, including unauthorized access to sensitive data, data modification, and potential remote command execution on the underlying server. Such a breach could lead to severe regulatory non-compliance, loss of intellectual property, and significant operational disruption.

Immediate Action: Upgrade to Agentis version 4.32 or later immediately to remediate the vulnerable input handling.

Proactive Monitoring: Monitor database query logs for suspicious syntax or unexpected patterns indicative of SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block SQL injection payloads targeting the application.

Public Exploit Available: No (exploit_available: false)

Due to the critical severity and the lack of authentication required for exploitation, this issue must be addressed with the highest priority. Administrators should apply the vendor-provided update immediately and audit database access logs for signs of prior unauthorized activity.