SQL Injection is present in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint in Flowring Agentflow 4.0. The vulnerability allows remote attackers to craft a malicious id parameter that is concatenated directly into an SQL query, giving them the ability to execute arbitrary SQL commands against the database. This can lead to data exposure, modification, or deletion, and if the database user has elevated privileges it may allow attackers to gain broader system access via stored procedures or privileged database operations.

Affected systems are installations of Flowring Technology Corp’s Agentflow 4.0 prior to the release dated 2025/08/08.

The CVSS score of 9.3 reflects a high severity. The EPSS score is below 1%, indicating a low likelihood of immediate exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, through HTTP requests to the vulnerable API endpoint, and requires the attacker to have network connectivity to the server exposing the endpoint. No additional authentication is mentioned, implying the endpoint is potentially accessible to unauthenticated or publicly reachable clients.