CVE-2026-96428

Executive Summary

CVE-2026-96428 is a SQL Injection vulnerability in the /WebAgenda/SMBAjaxAutoComplete.do endpoint of Flowring Agentflow 4.0 (versions prior to 2025/08/08). A remote, unauthenticated attacker can inject arbitrary SQL commands through the words parameter, potentially leading to full database compromise. The advisory contains no patch evidence and no public exploit code, so organizations running exposed Agentflow instances should treat this as an active, unpatched risk pending vendor confirmation.

Technical Analysis

The vulnerability resides in the SMBAjaxAutoComplete.do endpoint within the /WebAgenda/ path of Flowring Agentflow 4.0. The endpoint accepts a words parameter — its name suggests an autocomplete function, which characteristically takes partial user input and queries a backend datastore to return matching suggestions. This is a classic design pattern that maps user-supplied strings directly into a database query.

The CVE is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The NVD description states plainly that the flaw "allows remote attackers to execute arbitrary SQL commands via the words parameter." This means the application fails to neutralize SQL metacharacters (e.g., quotes, comment markers, boolean operators) before constructing its query. An attacker who controls the words value can therefore alter the structure and logic of the underlying SQL statement.

Key technical observations derivable from the description:

• Attack vector: Network (remote).
• Authentication: None stated — the endpoint is treated as remotely reachable, implying either an unauthenticated autocomplete route or one reachable without meaningful auth checks.
• Injection point: The words request parameter of SMBAjaxAutoComplete.do.
• Impact class: Arbitrary SQL command execution against the backend database.

The description does not disclose the parameter's expected type, the query construction method (string concatenation vs. dynamic SQL), the backend DBMS vendor, or whether the injection is error-based, union-based, boolean-based, or time-based. Those specifics are not available in the provided intelligence and should not be assumed. Similarly, the description does not confirm whether stacked queries are possible, which determines whether command execution at the OS layer (e.g., via xp_cmdshell) is feasible.

The .do extension conventionally indicates a Java servlet/Struts-style action mapping, and "Agentflow" is a business process / workflow management product line, which typically sits behind authentication and integrates with corporate directories and databases. This contextual inference should be treated as contextual, not confirmed by the advisory.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (SQL injection via an HTTP parameter). Steps marked "inferred" are not confirmed by the advisory.

1. Reconnaissance / target identification (inferred): An attacker identifies internet- or intranet-exposed Flowring Agentflow 4.0 deployments, for example via Shodan queries such as http.title:"Agentflow" or by fingerprinting the /WebAgenda/SMBAjaxAutoComplete.do path. Version identification via banners, login pages, or asset inventories helps scope targets below the 2025/08/08 revision.

2. Triggering the flaw class: The attacker sends an HTTP request to /WebAgenda/SMBAjaxAutoComplete.do supplying a crafted value in the words parameter. Because the input is not properly neutralized before being placed into a SQL statement, the injected metacharacters are interpreted as SQL rather than data.

3. Payload/execution method (class-level): At the vulnerability-class level, the attacker would manipulate the query logic using standard SQL injection primitives — for example boolean conditions to probe true/false behavior, or other injection techniques suited to the backend DBMS — to enumerate schema objects and extract or modify data. The specific DBMS, injection technique, and any ability to execute operating-system commands are not specified in the advisory and are therefore unconfirmed.

4. Post-exploitation impact (inferred): Successful exploitation grants the attacker the privileges of the database account used by the application. Depending on that account's rights, the attacker could read sensitive records (business process data, credentials, customer data), tamper with or delete records, and — if the account is highly privileged and the DBMS supports it — pivot toward further internal access. The exact blast radius depends on database permissions and network segmentation, neither of which is disclosed.

Because the endpoint name implies an autocomplete feature, the request is likely lightweight and may not require authentication, making it attractive for automated scanning. However, this is an inference from the endpoint naming convention, not a confirmed fact from the advisory.

Impact Assessment

If exploited, CVE-2026-96428 allows an attacker to execute arbitrary SQL commands. The confidentiality, integrity, and availability impact depends on the database account privileges and the sensitivity of the data managed by Agentflow. Workflow/BPM platforms frequently store process definitions, user directories, and integration credentials, so a compromise could cascade into adjacent systems. No CVSS score or vector is published for this CVE (NVD lists none; EPSS is not yet assigned). The impact narrative above is therefore qualitative rather than metric-driven, and the CVSS vector provided in the METADATA section is a representative baseline for an unauthenticated network SQL injection, not a vendor-confirmed score.

Detection Guidance

Sigma Rule

title: Flowring Agentflow SMBAjaxAutoComplete SQL Injection Attempt
id: 8f2c1a44-3b7e-4d9a-9c11-96428agentflow
status: experimental
description: Detects SQL injection patterns targeting the words parameter of the Flowring Agentflow /WebAgenda/SMBAjaxAutoComplete.do endpoint.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96428
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|endswith: '/WebAgenda/SMBAjaxAutoComplete.do'
  selection_param:
    cs-uri-query|contains:
      - 'words='
  selection_sqli:
    cs-uri-query|contains:
      - "'"
      - '--'
      - '/*'
      - ' or '
      - ' union '
      - 'select '
      - 'sleep('
      - 'benchmark('
  condition: selection_uri and selection_param and selection_sqli
falsepositives:
  - Legitimate autocomplete queries containing apostrophes in search terms
level: high

YARA Rule

rule CVE_2026_96428_Flowring_Agentflow_SQLi
{
    meta:
        description = "Detects SQL injection payloads targeting Flowring Agentflow SMBAjaxAutoComplete.do words parameter"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96428"
        cve = "CVE-2026-96428"
        author = "Threat Intelligence"
        date = "2026-01-01"

    strings:
        $ep = "/WebAgenda/SMBAjaxAutoComplete.do" ascii nocase
        $p1 = "words=" ascii nocase
        $s1 = "union" ascii nocase
        $s2 = "select" ascii nocase
        $s3 = "sleep(" ascii nocase
        $s4 = "benchmark(" ascii nocase
        $s5 = "information_schema" ascii nocase
        $c1 = "'" ascii
        $c2 = "--" ascii
        $c3 = "/*" ascii

    condition:
        $ep and $p1 and (any of ($s*)) and (any of ($c*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96428 Flowring Agentflow SMBAjaxAutoComplete SQL Injection Attempt"; flow:established,to_server; http.uri; content:"/WebAgenda/SMBAjaxAutoComplete.do"; http.uri; content:"words="; pcre:"/words=[^&]*(union|select|sleep\(|benchmark\(|information_schema|%27|'|--)/i"; classtype:web-application-attack; reference:cve,2026-96428; sid:202696428; rev:1;)

Elastic Detection

network where
  url.path == "/WebAgenda/SMBAjaxAutoComplete.do" and
  url.query like~ "*words=*" and
  (url.query like~ "*union*" or
   url.query like~ "*select*" or
   url.query like~ "*sleep(*" or
   url.query like~ "*benchmark(*" or
   url.query like~ "*information_schema*" or
   url.query like~ "*%27*" or
   url.query like~ "*--*")

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%/WebAgenda/SMBAjaxAutoComplete.do%")
| where like(uri_query, "%words=%")
| where match(uri_query, "(?i)(union|select|sleep\\(|benchmark\\(|information_schema|%27|--|/\\*)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_query
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,sqli,">
  <rule id="2026964" level="12">
    <if_sid>31100</if_sid>
    <url>/WebAgenda/SMBAjaxAutoComplete.do</url>
    <match>words=</match>
    <regex>(?i)(union|select|sleep\(|benchmark\(|information_schema|%27|--|/\*)</regex>
    <description>CVE-2026-96428: SQL injection attempt against Flowring Agentflow SMBAjaxAutoComplete.do words parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict network access to /WebAgenda/SMBAjaxAutoComplete.do and the Agentflow management interfaces via firewall rules or a reverse proxy/WAF; do not expose them directly to the internet.
   • Deploy a WAF rule (or the Suricata/Sigma detections above) to block requests containing SQL metacharacters in the words parameter, understanding that WAF filtering is a compensating control, not a fix.
   • Require authentication/authorization in front of the affected endpoint if it is currently reachable unauthenticated (verify actual behavior before relying on this).
   • Run the application's database account with least privilege — no xp_cmdshell, no broad read/write beyond what the app requires.

2. Patch / upgrade steps

   • Apply the vendor fix as soon as Flowring publishes an advisory for the 2025/08/08 revision. Check the Flowring/Agentflow vendor support channel directly, since no public advisory or patch reference is tracked for this CVE.
   • Until a fix is confirmed, treat affected versions as unpatched and rely on the mitigations above.

3. Long-term hardening

   • Enforce parameterized queries / prepared statements for all database access, eliminating dynamic SQL string concatenation.
   • Conduct a code review of other .do endpoints taking user input, as the same defect may exist elsewhere.
   • Implement centralized logging and alerting on web-tier SQL error patterns and injection signatures.
   • Maintain an SBOM/asset inventory of internet-exposed workflow platforms to rapidly scope future advisories.

References

• NVD — CVE-2026-96428: https://nvd.nist.gov/vuln/detail/CVE-2026-96428
• MITRE CWE-89 (SQL Injection): https://cwe.mitre.org/data/definitions/89.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Flowring / Agentflow vendor support portal (consult directly for advisory and patch availability)

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-96428 in the data provided; CISA KEV status is NO and no public PoC or Nuclei template exists.