SQLBot contains an SQL injection flaw in the /api/v1/datasource/uploadExcel endpoint that grants remote code execution. The vulnerability stems from unsanitized Excel sheet names being concatenated into PostgreSQL table names and then embedded in COPY SQL statements through f-strings. An attacker can manipulate the sheet name to inject a TO PROGRAM 'sh' clause, enabling arbitrary shell commands to run as the database postgres user. This leads to exfiltration of sensitive files and full database compromise. The weakness matches CWE-78 (Command Injection) and CWE-89 (SQL Injection).

Versions of SQLBot before 1.7.0 are vulnerable. The product, developed by the dataease organization, is affected when its uploadExcel endpoint is used with Excel files that contain specially crafted sheet names. Users of the earlier releases should verify the version they are running and consider whether the endpoint is publicly accessible.

The CVSS score is 8.6, indicating high severity. EPSS is reported as less than 1%, suggesting low overall exploit probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user, but the attack can be performed by the lowest-privileged accounts with access to the upload endpoint. By following a two-stage upload process—first submitting a normal file with malicious data rows, then an XML‑tampered file to inject the SQL payload—an attacker can bypass the 31‑character sheet name limit and execute commands on the backend server.