CVE-2024-7099
SQL Injection in netease-youdao/qanything
Résumé
SQL Injection in netease-youdao/qanything
Description d'origine
La description telle que publiée par la source (souvent en anglais).
netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include get_knowledge_base_name, from_status_to_status, delete_files, and get_file_by_status. An attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially stealing information from the database. The issue is fixed in version 1.4.2.
Références
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web huntr.com