CVE-2024-7099
SQL Injection in netease-youdao/qanything
Summary
SQL Injection in netease-youdao/qanything
Original description
The description as published by the source.
netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include get_knowledge_base_name, from_status_to_status, delete_files, and get_file_by_status. An attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially stealing information from the database. The issue is fixed in version 1.4.2.
References
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web huntr.com