CVE-2026-96430

Executive Summary

CVE-2026-96430 is a dangerous-method exposure vulnerability (CWE-749) in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0, where an exposed function accepts an sql parameter and executes it directly. Remote authenticated users can supply arbitrary SQL through this parameter, resulting in database compromise, data disclosure, and potential full application takeover. The vulnerability is currently unpatched and no public proof-of-concept or Nuclei template is available, so detection depends on behavioral monitoring of the exposed endpoint.

Technical Analysis

The affected component is Flowring Agentflow, an enterprise workflow and business-process automation product. The vulnerable surface is the SQLWin.do endpoint under the /WebAgenda/ web path. According to the NVD description, this endpoint exposes a dangerous method or function — classified as CWE-749 — that accepts a caller-supplied sql parameter and executes it as a SQL command. The flaw is not a classic string-concatenation injection into a parameterized query; rather, the endpoint appears to intentionally expose a raw SQL execution capability (a "SQL window" style administrative or reporting function) to authenticated callers, without restricting what statements may be submitted.

The core mechanism is therefore functionality exposure rather than input-sanitization failure: the application provides a legitimate server-side SQL execution entry point, and the access control on that entry point is insufficient. Because the endpoint is a .do action, requests are conventional HTTP requests (GET or POST) accepted by the Agentflow web tier, and the sql parameter carries the attacker's statement. The vulnerability requires authentication ("remote authenticated users"), meaning the attacker must first hold a valid low-privileged Agentflow session. Once authenticated, however, the sql parameter permits arbitrary SQL — SELECT, INSERT, UPDATE, DELETE, and, depending on the backend database engine and the privileges of the application's database account, DDL or stored-procedure execution.

No information is available in the provided data about the underlying database engine, the exact privileges of the application's database connection, or the presence of any allow-list or statement-type filtering. Accordingly, the specific SQL dialect, table names, and query shapes that would succeed cannot be confirmed from the source data. The attack surface exposure and the dangerous function class are, however, explicit.

The affected version range is Agentflow 4.0 prior to the date "2026/08/28" as stated in the description; this date functions as the vendor's remediation marker. No version list beyond this boundary is provided, so no finer-grained affected-version matrix can be asserted.

Exploitation Scenarios

Attack chain, reconstructed strictly from the vulnerability class and the details in the NVD description. No public PoC is available, so the sequence below is inferred from CWE-749 and the exposed sql parameter and does not rely on any confirmed exploit code.

1. Reconnaissance and target identification. An attacker identifies Flowring Agentflow 4.0 deployments exposed to the network — typically internet-facing or internally reachable web tiers serving the /WebAgenda/ application. Fingerprinting can be performed by requesting the Agentflow login or landing pages and by checking for the /WebAgenda/SQLWin.do path. Because the endpoint is a .do action, its presence indicates the product and the likely vulnerable build.

2. Authentication. Because the CVE explicitly targets remote authenticated users, the attacker must first obtain a valid Agentflow session. This may be achieved with legitimate low-privileged credentials, credentials obtained through phishing or credential reuse, or by chaining a separate authentication bypass. The vulnerability does not require administrator privileges; only a valid authenticated context.

3. Triggering the dangerous function. With a valid session, the attacker sends an HTTP request to /WebAgenda/SQLWin.do and supplies a SQL statement in the sql parameter. The exposed method on the server side consumes that parameter and executes it against the backend database. No special payload crafting is required beyond valid SQL, since the endpoint is designed to run the supplied statement.

4. Post-exploitation impact. Arbitrary SQL execution against the Agentflow database enables reading sensitive records such as user accounts, workflow definitions, business data, and any credentials stored in database tables; modifying or deleting records to tamper with workflow state; and — where the application's database account holds sufficient privileges — creating or altering database objects. In configurations where the database engine permits filesystem writes or OS command execution through database features, the impact can escalate to host-level compromise, though the provided data does not confirm such capability for this deployment.

Because no exploit code, Nuclei template, or in-the-wild campaign is documented, the practical exploitation probability is governed primarily by the number of reachable Agentflow instances and by whether the exposed endpoint is accessible with ordinary authenticated sessions.

Impact Assessment

The vulnerability permits any authenticated remote user to run arbitrary SQL, which directly undermines the confidentiality, integrity, and availability of the Agentflow database and the business processes it stores. Sensitive data — user accounts, workflow/business records, and potentially stored credentials — can be exfiltrated; data can be altered or destroyed; and workflow integrity can be silently manipulated. If the database account holds elevated privileges, impact extends to the database host and potentially to other systems trusted by it.

CVSS is not provided (NVD lists N/A), and EPSS has not yet been scored by FIRST.org, so no quantitative scoring is available from the data. Impact is bounded by the requirement for an authenticated session and by the privilege of the application's database account, both of which are unknowns. Blast radius includes all Agentflow 4.0 deployments exposing /WebAgenda/SQLWin.do to authenticated users, particularly internet-facing or widely reachable enterprise workflow installations. No CISA KEV listing exists, and no known active exploitation is reported.

Detection Guidance

Sigma Rule

title: Flowring Agentflow SQLWin.do SQL Injection Attempt (CVE-2026-96430)
id: 4c9a7e2b-1f3d-4a6e-9b8c-7d5e2f0a1c33
status: experimental
description: Detects HTTP requests to the Agentflow /WebAgenda/SQLWin.do endpoint carrying SQL-like content in the sql parameter, consistent with CVE-2026-96430 abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96430
author: Valters IT Threat Intelligence
date: 2026/06/01
tags:
  - attack.t1190
  - attack.initial_access
  - cve.2026-96430
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains: '/WebAgenda/SQLWin.do'
  selection_method:
    cs-method:
      - GET
      - POST
  selection_sql:
    cs-uri-query|contains:
      - 'sql='
      - 'SELECT'
      - 'INSERT'
      - 'UPDATE'
      - 'DELETE'
      - 'UNION'
      - 'DROP'
  condition: selection_uri and selection_method and selection_sql
fields:
  - c-ip
  - cs-username
  - cs-uri-query
  - cs-method
falsepositives:
  - Authorized administrative use of the SQL window function
level: high

YARA Rule

rule CVE_2026_96430_Agentflow_SQLWin_Exploit
{
    meta:
        description = "Detects payloads or artifacts referencing the Flowring Agentflow SQLWin.do dangerous method (CVE-2026-96430)"
        author = "Valters IT Threat Intelligence"
        date = "2026-06-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96430"
        severity = "high"

    strings:
        $endpoint = "/WebAgenda/SQLWin.do" ascii wide nocase
        $param    = "sql=" ascii wide nocase
        $sql1     = "UNION SELECT" ascii wide nocase
        $sql2     = "OR 1=1" ascii wide nocase
        $sql3     = "SELECT" ascii wide nocase
        $sql4     = "INFORMATION_SCHEMA" ascii wide nocase

    condition:
        $endpoint and (any of ($param) or any of ($sql*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96430 Flowring Agentflow SQLWin.do SQL execution attempt"; flow:established,to_server; http.uri; content:"/WebAgenda/SQLWin.do"; nocase; http.uri; content:"sql="; nocase; pcre:"/(SELECT|INSERT|UPDATE|DELETE|UNION|DROP|INFORMATION_SCHEMA)/iU"; classtype:web-application-attack; reference:cve,2026-96430; sid:202696430; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where http.request.method in ("GET","POST") and
      http.request.uri : "/WebAgenda/SQLWin.do*" ]
  [ network where http.request.uri : "*sql=*" and
      process.name : "*" and
      http.request.uri : ("*SELECT*" or "*UNION*" or "*SELECT+*" or "*INSERT*" or "*UPDATE*" or "*DELETE*" or "*DROP*") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis
| where like(cs_uri_stem, "%/WebAgenda/SQLWin.do%") OR like(uri_path, "%/WebAgenda/SQLWin.do%")
| search (uri_query="*sql=*" OR cs_uri_query="*sql=*")
| regex uri_query="(?i)(SELECT|INSERT|UPDATE|DELETE|UNION|DROP|INFORMATION_SCHEMA|OR\+1%3D1)"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_query) as queries by src_ip, user, cs_uri_stem
| sort - count

Wazuh OSSEC Rule

<group name="web,agentflow,cve-2026-96430,">
  <rule id="2026965" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>/WebAgenda/SQLWin.do</url>
    <regex>(?i)sql=.*(SELECT|INSERT|UPDATE|DELETE|UNION|DROP|INFORMATION_SCHEMA)</regex>
    <description>CVE-2026-96430: Flowring Agentflow SQLWin.do SQL execution attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,sql_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict network access to the /WebAgenda/SQLWin.do endpoint at the reverse proxy, WAF, or application tier — ideally blocking the path entirely for all non-administrative roles, or restricting it to trusted management source IPs. Enforce strict role-based access control so that ordinary authenticated users cannot reach SQL execution functionality. Deploy a WAF rule matching the Suricata/Sigma signatures above to block requests carrying SQL statements in the sql parameter. Reduce the privileges of the Agentflow database account to the minimum required, so that arbitrary SQL cannot escalate to DDL or OS-level actions. Audit Agentflow user accounts and sessions for anomalous or unauthorized activity.

2. Patch/upgrade steps. The NVD description indicates remediation is expected before 2026/08/28, and no fixed version is enumerated by any tracked source. Track the vendor's advisories and apply the vendor-supplied update once released; the description's date should be treated as the remediation boundary for Agentflow 4.0. If the vendor clarifies a fixed build number, upgrade directly to that version and re-test the endpoint.

3. Long-term hardening. Eliminate the exposed raw SQL execution method from the product architecture, or replace it with a narrowly parameterized, authorization-gated interface. Apply the principle of least privilege to all application database accounts, enforce parameterized queries everywhere, and conduct a systematic audit of all .do action endpoints for similar dangerous-method exposure. Add continuous monitoring for the endpoint and periodic review of authenticated-user access patterns to detect abuse.