This vulnerability involves SQL injection in the SAS Studio 9.4 web interface endpoint /SASStudio/sasexec/sessions/{sessionID}/sql. A remote attacker with authorized user privileges can send crafted POST requests containing SQL commands, potentially executing arbitrary SQL statements. The vendor disputes the classification as a vulnerability, stating that SQL execution is permitted for authorized users, implying that the risk is limited to users who already have access rights. The CVSS 3.1 base score is 8.8, indicating high severity due to network attack vector, low attack complexity, required privileges, and high impact on confidentiality, integrity, and availability. There is no known exploit in the wild and no patch or remediation information provided.

An attacker with authorized user privileges can execute arbitrary SQL commands remotely, potentially leading to full compromise of the database confidentiality, integrity, and availability. However, since SQL execution is an intended capability for authorized users, the impact is limited to misuse by those with legitimate access. There is no indication of privilege escalation or exploitation by unauthorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor disputes this as a vulnerability due to intended functionality for authorized users, no immediate mitigation steps are provided. Organizations should ensure strict access control and monitoring of authorized users to prevent misuse of SQL execution capabilities.