An authenticated SQL injection vulnerability in the iFlytek astron-agent getBotList API endpoint could allow an attacker to gain unauthorized database access and manipulate application data.

This is a SQL injection flaw (CWE-89) located within the getBotList API endpoint, specifically triggered by improper neutralization of the sortDirection argument in the ChatBotMarketMapper.xml file. The vulnerability requires the attacker to have low-level authenticated access to the system.

The ability to perform SQL injection poses a significant risk to the confidentiality, integrity, and availability of the backend database. Successful exploitation could allow an attacker to bypass security controls, extract sensitive information, or modify critical application data, potentially leading to unauthorized system control. While the CVSS score of 6.3 reflects a moderate severity, the potential for database compromise necessitates timely remediation to prevent data breaches.

Immediate Action: Update the iFlytek astron-agent component to version reward-1575 or later to apply the official fix provided in commit 6702be70ae802b1048f5fbec91e690e7b71a4165.

Proactive Monitoring: Review database query logs for unusual syntax, unexpected character patterns, or attempts to access unauthorized tables originating from the getBotList API endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated SQL injection detection rules to inspect incoming traffic and block malformed payloads targeting the sortDirection parameter.

Public Exploit Available: Unknown

Organizations utilizing iFlytek astron-agent must prioritize upgrading to version reward-1575 immediately. Given that this vulnerability allows for remote SQL injection, failure to patch may expose the underlying database to unauthorized manipulation. Ensure that all internal access controls are strictly enforced to minimize the risk of authenticated attackers exploiting this flaw.