Product
Authenticated non-admin users can execute arbitrary system commands in Aix-DB version 1.2.4 by exploiting an unvalidated execute tool within the ChatBI agent via crafted HTTP requests.