CVE-2023-30558: Multiple SQL injections in sql/data_dictionary.py table_list method in Archery - GHSL-2022-105
First published: Tue Apr 18 2023(Updated: )
Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. User input coming from the `db_name` in the `sql/data_dictionary.py` `table_list` endpoint is passed to the methods that follow in a given SQL engine implementations, which concatenate user input unsafely into a SQL query and afterwards pass it to the `query` method of each database engine for execution. The affected methods are `get_group_tables_by_db` in `sql/engines/mssql.py`which passes unsafe user input to `sql/engines/mssql.py`, and `get_group_tables_by_db` in `sql/engines/oracle.py`which concatenates input which is passed to execution on the database in the `sql/engines/oracle.py` `query` method. Each of these issues may be mitigated by escaping user input or by using prepared statements when executing SQL queries. This issue is also indexed as `GHSL-2022-105`.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Archerydms Archery | =1.9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-30558?
CVE-2023-30558 is a SQL injection vulnerability in the Archery project, specifically in the `sql/data_dictionary.py` `table_list` endpoint.
How does CVE-2023-30558 affect Archery?
CVE-2023-30558 affects Archery version 1.9.0, allowing an attacker to query connected databases through SQL injection.
What is the severity of CVE-2023-30558?
The severity of CVE-2023-30558 is medium with a CVSS score of 6.5.
How can I fix CVE-2023-30558?
To fix CVE-2023-30558, users should update to a version of Archery that is not affected by this vulnerability.
Where can I find more information about CVE-2023-30558?
More information about CVE-2023-30558 can be found at the following link: [GitHub Advisory](https://github.com/hhyo/Archery/security/advisories/GHSA-jwjj-jgfv-x66q).
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/references
- agent/last-modified-date
- agent/title
- agent/severity
- agent/first-publish-date
- agent/event
- agent/tags
- agent/description
- vendor/archerydms
- canonical/archerydms archery
- version/archerydms archery/1.9.0