CVE-2023-30556: SQL injection in sql_optimize.py optimize_sqltuningadvisor method in Archery - GHSL-2022-107
First published: Tue Apr 18 2023(Updated: )
Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the `optimize_sqltuningadvisor` method of `sql_optimize.py`. User input coming from the `db_name` parameter value in `sql_optimize.py` is passed to the `sqltuningadvisor` method in `oracle.py`for execution. To mitigate escape the variables accepted via user input when used in `sql_optimize.py`. Users may also use prepared statements when dealing with SQL as a mitigation for this issue. This issue is also indexed as `GHSL-2022-107`.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Archerydms Archery | =1.9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-30556?
CVE-2023-30556 is a SQL Injection vulnerability in the Archery project.
How severe is CVE-2023-30556?
CVE-2023-30556 has a severity rating of 6.5, which is considered medium.
What is the affected version of Archery?
Archery version 1.9.0 is affected by CVE-2023-30556.
How can an attacker exploit CVE-2023-30556?
An attacker can exploit CVE-2023-30556 by injecting SQL queries into the 'optimize_sqltuningadvisor' method of 'sql_optimize.py' in Archery.
Is there a fix for CVE-2023-30556?
Yes, updating to a version of Archery that is not affected by CVE-2023-30556 will fix the vulnerability.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/references
- agent/last-modified-date
- agent/title
- agent/severity
- agent/first-publish-date
- agent/event
- agent/tags
- agent/description
- vendor/archerydms
- canonical/archerydms archery
- version/archerydms archery/1.9.0