CVE-2023-30554: SQL injection in sql_api/api_workflow.py endpoint in Archery - GHSL-2022-103
First published: Tue Apr 18 2023(Updated: )
Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the `sql_api/api_workflow.py` endpoint `ExecuteCheck` which passes unfiltered input to the `explain_check` method in `sql/engines/oracle.py`. User input coming from the `db_name` parameter value in the `api_workflow.py` `ExecuteCheck` endpoint is passed through the `oracle.py` `execute_check` method and to the `explain_check` method for execution. Each of these issues may be mitigated by escaping user input or by using prepared statements when executing SQL queries. This issue is also indexed as `GHSL-2022-103`.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Archerydms Archery | =1.9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-30554?
CVE-2023-30554 is a vulnerability in the Archery open source SQL audit platform that allows for SQL injection attacks.
How does CVE-2023-30554 affect Archery?
CVE-2023-30554 affects Archery versions 1.9.0, allowing an attacker to perform SQL injection attacks on the connected databases.
What is the severity of CVE-2023-30554?
The severity of CVE-2023-30554 is rated as medium with a severity value of 6.5.
What is the impact of CVE-2023-30554?
CVE-2023-30554 allows an attacker to query connected databases through SQL injection, potentially exposing sensitive information.
How can I fix CVE-2023-30554?
To fix CVE-2023-30554, it is recommended to update to a patched version of Archery.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/references
- agent/last-modified-date
- agent/title
- agent/severity
- agent/first-publish-date
- agent/event
- agent/tags
- agent/description
- vendor/archerydms
- canonical/archerydms archery
- version/archerydms archery/1.9.0