SQLBot, an intelligent data query system, contains a server‑side request forgery flaw that lets an attacker configure a forged MySQL data source with a malicious parameter. During connectivity checks, the backend handshakes with a rogue MySQL server that issues a LOAD DATA LOCAL INFILE command, forcing the SQLBot server to read any file it can access and return the contents to the attacker. This yields arbitrary file read, compromising sensitive configuration, credential, or user data.

The vulnerability affects all releases of SQLBot before version 1.7.0, including the dataease:SQLBot product. It applies to environments that expose the /api/v1/datasource/check endpoint and permit configuration of external MySQL data sources with the local_infile option enabled.

The CVSS score of 8.7 classifies the flaw as high severity. EPSS is below 1%, indicating that exploiting this vulnerability is currently unlikely, and it is not listed in the CISA KEV catalog. Nevertheless, the attack can be carried out remotely by sending a crafted request to the exposed endpoint; the attacker only needs to set up a rogue MySQL server with the malicious LOAD DATA LOCAL INFILE statement. Because the flaw succeeds in reading arbitrary files, the potential impact on confidentiality is significant, and the exploitation does not require privileged access beyond the exposed API.