An unauthenticated SQL injection vulnerability in AiFlowy allows remote attackers to compromise sensitive database information, posing a significant risk to data confidentiality.

The application is susceptible to SQL injection via the getPageData method within the DatacenterQuery.java file. This flaw permits an unauthenticated attacker to inject malicious SQL queries to access unauthorized data.

Successful exploitation of this vulnerability results in the unauthorized disclosure of sensitive database contents. With a CVSS score of 7.5, this high-severity flaw threatens data integrity and regulatory compliance, potentially leading to significant reputational and operational damage if sensitive information is exfiltrated.

Immediate Action: Since no specific patch version is currently identified, contact the vendor for an update or apply the latest available version of AiFlowy.

Proactive Monitoring: Monitor application logs for suspicious database queries, particularly those originating from external sources targeting the getPageData method.

Compensating Controls: Deploy a Web Application Firewall (WAF) with configured rules to detect and block SQL injection patterns in incoming HTTP requests.

Public Exploit Available: Yes, a public proof-of-concept exists, attributed to the researcher's write-up referenced in the CVE record.

Given the ease of exploitability and the potential for unauthorized data access, organizations should prioritize restricting external access to the affected component. If an immediate vendor patch is unavailable, implement strict input validation and WAF filtering to mitigate the risk of exploitation until a formal security update can be applied.