The flaw is a local SQL injection vulnerability arising from the manipulation of the Description parameter in the terminology_retriever.py component of apconw Aix-DB. By injecting malicious SQL statements, an attacker who can execute code on the affected system may read, modify, or delete data stored in the database. The weakness is a classic example of CWE‑74 (Improper Neutralization of Special Elements used in an SQL Command) and CWE‑89 (SQL Injection).

apconw Aix-DB versions up to and including 1.2.3 are susceptible. The vulnerability originates in the agent/text2sql/rag/terminology_retriever.py module. No specific revision or patch level is provided beyond the 1.2.3 ceiling.

The CVSS v3.1 base score of 4.8 reflects a moderate severity. The exploit requires local access, meaning an attacker must already have the ability to run code or log into the system. An attacker can use the publicly disclosed exploit to trigger the injection and compromise data. EPSS information is missing and the issue is not listed in the CISA KEV catalog, suggesting that while publicized, it has not yet attracted widespread exploitation.