CVE-2024-7099
SQL Injection in netease-youdao/qanything
概要
SQL Injection in netease-youdao/qanything
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include get_knowledge_base_name, from_status_to_status, delete_files, and get_file_by_status. An attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially stealing information from the database. The issue is fixed in version 1.4.2.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web huntr.com