CVE-2024-7099: SQL Injection in netease-youdao/qanything
netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include getknowledgebasename, fromstatustostatus, deletefiles, and getfilebystatus. An attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially stealing information from the database. The issue is fixed in version 1.4.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7099?
CVE-2024-7099 has a high severity rating due to its potential for SQL injection attacks.
How do I fix CVE-2024-7099?
To fix CVE-2024-7099, update the netease-youdao/qanything package to version 1.4.2 or later.
What are the impacted functions in CVE-2024-7099?
The impacted functions in CVE-2024-7099 include get_knowledge_base_name, from_status_to_status, delete_files, and get_file_by_status.
Is CVE-2024-7099 specific to certain versions of the software?
Yes, CVE-2024-7099 specifically affects netease-youdao/qanything versions prior to 1.4.2.
What type of vulnerability is CVE-2024-7099?
CVE-2024-7099 is categorized as an SQL injection vulnerability.