This vulnerability affects BMC Control-M/MFT versions 9.0.20 to 9.0.22 and involves a SQL injection flaw in the MFT API's debug interface. An authenticated attacker can inject malicious SQL queries due to insufficient input validation and unsafe dynamic SQL construction. Successful exploitation can result in arbitrary file read/write capabilities and potentially remote code execution on the affected system. The vulnerability was published without an associated CVSS score or vendor remediation details.

If exploited, an authenticated attacker could perform arbitrary file read and write operations on the affected system, which may lead to remote code execution. This could compromise the confidentiality, integrity, and availability of the system running BMC Control-M/MFT. No evidence of active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the MFT API debug interface to trusted users only and monitor for suspicious activity. Avoid exposing the debug interface to untrusted networks.