Pixa Bank 2.0 has a SQL injection flaw in the agence-ajax.php API that allows attackers to inject arbitrary SQL through the rib parameter. An unauthenticated attacker can craft a POST request containing a UNION-based payload, causing the database to return rows that include personal information such as user names, email addresses, and phone numbers. This enables the theft of sensitive data without requiring any credentials, effectively compromising user confidentiality.

The flaw affects Pixastudio’s Pixa Bank version 2.0, specifically the agence-ajax.php endpoint that processes POST requests with the rib parameter.

The vulnerability carries a CVSS score of 8.8, categorizing it as high risk, with no EPSS score reported and no KEV designation. Attackers need only send an unauthenticated HTTP POST to the exposed endpoint, which most likely resides on a publicly accessible web server. If the application is reachable, the exploitation is straightforward and does not require advanced skills, indicating a relatively high likelihood of exploitation in practice.