The backend report module in smart‑web2 v1.3.1 stores the sqlResource.sql parameter exactly as supplied in the t_report_sql_resource table and later injects that value into Hibernate native queries without any form of parameterization or filtering. This flaw allows an attacker to execute arbitrary SQL commands, potentially reading, modifying, or deleting data stored by the application. The vulnerability is a classic example of an SQL injection weakness, which can lead to data disclosure, data tampering, and possibly escalation of privileges if the database contains sensitive information. The impact is limited to the database scope of the smart‑web2 application, but the consequences can be severe if critical business data or authentication credentials are stored in that database.

smart‑web2 version 1.3.1 is affected. No other vendors or product versions are listed in the official CNA data. The flaw resides in the ReportController.save() interface of the free‑source smart‑web2 backend, as documented in a GitHub advisory.

No CVSS score is publicly available for this entry; the EPSS score is not published, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, an attacker would need to send a crafted HTTP request to the ReportController.save() endpoint with a malicious sqlResource.sql payload. The attack is likely remote and does not require authentication, making the threat surface broad. Without the detailed metrics, the exact risk level is indeterminate, but the presence of an arbitrary SQL execution flaw typically indicates a high severity if the data integrity is critical.