Sparx Pro Cloud Server evaluates authentication solely based on the requested URL, ignoring input in binary POST payloads. By omitting the mandatory "model" query parameter and instead sending only the model name in the binary body of a POST request, an attacker can cause the server to construct and execute arbitrary SQL statements. The lack of authentication verification permits the attacker to read, modify, or delete database contents, thereby compromising data integrity and availability.

This vulnerability impacts Sparx Systems Pro Cloud Server, specifically version 6.1 build 167 and all earlier builds. Subsequent versions have not yet been tested for this issue, though they may also be susceptible.

The CVSS score of 9.3 classifies this flaw as critical. Although the EPSS score is not available, the lack of a vendor patch combined with the ability to execute arbitrary SQL commands without authentication keeps the risk extremely high. The vulnerability is not yet listed in the CISA KEV catalog, yet the absence of a vendor response raises the likelihood that exploitation attempts may already be underway.