A critical SQL injection vulnerability in Eosphoros-AI DB-GPT allows unauthenticated remote attackers to compromise the underlying database, posing a severe risk to data integrity and confidentiality.

This is a SQL injection vulnerability (CWE-89) located in the /api/v1/editor/ component. The flaw is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS attack vector (AV:N/PR:N).

Successful exploitation permits unauthorized access to the application database, potentially leading to data exfiltration, modification, or deletion. With a CVSS score of 7.3, this high-severity vulnerability represents a significant threat to business continuity and regulatory compliance, as the application fails to safely handle user-supplied input in a critical API path.

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the affected /api/v1/editor/ endpoint immediately.

Proactive Monitoring: Monitor database query logs for suspicious patterns, such as unexpected syntax or unauthorized access attempts originating from the API service account.

Compensating Controls: Deploy or update Web Application Firewall (WAF) rules to inspect and block malicious SQL injection payloads targeting the /api/v1/editor/ URI.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the referenced huntr.com bounty report.

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, this vulnerability requires immediate attention. Security teams must prioritize isolating the vulnerable component and applying network-level filtering to prevent unauthorized exploitation while awaiting a formal fix from the project maintainers.