The backend report module in smart‑web2 v1.3.1 stores the sqlResource.sql parameter exactly as supplied in the t_report_sql_resource table and later injects that value into Hibernate native queries without any form of parameterization or filtering. This flaw allows an attacker to execute arbitrary SQL commands, potentially reading, modifying, or deleting data stored by the application. The vulnerability is a classic example of an SQL injection weakness, which can lead to data disclosure, data tampering, and possibly escalation of privileges if the database contains sensitive information. The impact is limited to the database scope of the smart‑web2 application, but the consequences can be severe if critical business data or authentication credentials are stored in that database.

smart‑web2 version 1.3.1 is affected. No other vendors or product versions are listed in the official CNA data. The flaw resides in the ReportController.save() interface of the free‑source smart‑web2 backend, as documented in a GitHub advisory.

The CVSS score of 9.8 indicates a high severity vulnerability; the EPSS score is < 1% and the entry is not listed in CISA’s KEV catalog. Based on the description, an attacker would need to send a crafted HTTP request to the ReportController.save() endpoint with a malicious sqlResource.sql payload. The attack is likely remote and does not require authentication, making the threat surface broad. The presence of an arbitrary SQL execution flaw indicates a high risk to data confidentiality and integrity.