This vulnerability exists in the _execute_sql function of the Refiner Agent component in wbbeyourself MAC-SQL up to commit 31a9df5e0d520be4769be57a4b9022e5e34a14f4. It allows remote attackers to perform SQL injection by manipulating input to this function. The vulnerability is publicly known and exploitable remotely without user interaction. The product's rolling release approach means no fixed version numbers are available for affected or fixed releases. The vendor has not provided any advisory or patch information.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database, potentially leading to unauthorized data access, data modification, or disruption of service. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the vendor or community. Until a patch is released, consider restricting network access to the vulnerable component and applying any available input validation or query parameterization as a temporary mitigation.