SQL Injection in sqli (CVE-2026-42087)
Summary
SQL injection in sqli (CVE-2026-42087). Confidential information can be exposed externally. Exploitable via tsdb_lookup.
Original description
The description as published by the source.
Vulnerability Type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Attack type: Authenticated remote
Impact: Telemetry data disclosure and deletion
Affected components: openc3-tsdb (QuestDB)
A SQL injection vulnerability exists in the Time-Series Database (TSDB) component of COSMOS. The tsdb_lookup function in the cvt_model.rb file directly places user-supplied input into a SQL query without sanitizing the input. As a result, a user can break out of the initial SQL statement and execute arbitrary SQL commands, including deleting data.
Figure 1: Source code vulnerable to SQL injection
Additionally, the get_tlm_values RPC endpoint only requires “tlm” permissions, allowing any user with the Admin, Operator, Viewer, or Runner roles to send a request to the TSDB. This permission is defined in roles-permissions.md to allow for the user to view telemetry data, but this vulnerability also allows them to delete data and tables.
Figure 2: Source code showing the required permissions for the get_tlm_values endpoint
Sending a normal request to the endpoint brings back a single array of values for the parameter:
Figure 3: A normal request to the get_tlm_values endpoint
However, sending a specially crafted request within the start_time variable brings back all the data in the database:
Figure 4: The request and response after sending the SQL injection payload
This payload can be modified to executes SQL commands in t…
Source: NIST National Vulnerability Database NVD GitHub Advisory
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
OpenC3 COSMOS has a critical SQL injection flaw where unsanitized inputs can lead to unauthorized command execution and data access. This allows attackers to exploit the database, causing potential data theft or deletion. The issue is fixed in version 7.0.0-rc3. It's crucial to update to the latest version to prevent data loss.
A SQL injection vulnerability exists in OpenC3 COSMOS versions 6.7.0 to 7.0.0-rc2 within the TSDB component. This arises in the tsdb_lookup function in cvt_model.rb where unsanitized user input is injected into SQL queries. Exploiting the start_time parameter in the get_tlm_values endpoint allows execution of arbitrary SQL commands. The vulnerability is patched in version 7.0.0-rc3. It is crucial to sanitize all inputs and use parameterized queries as an immediate measure.
SQLインジェクションの脆弱性
OpenC3 COSMOSのTSDBコンポーネント、cvt_model.rb内のtsdb_lookup関数
critical
OpenC3 COSMOSをバージョン7.0.0-rc3以降にアップデートする
ユーザー入力のサニタイズとパラメータ化されたクエリの使用
SQLインジェクションが可能なパラメータの異常を監視
Related past incidents Similar incidents extracted from past CVEs
Java SE 7から発生したSQLインジェクション。ユーザー入力のサニタイズ不足が原因で不正なSQL実行が可能。
OpenSSLにおけるHeartbleed脆弱性は、認証されていない攻撃者にメモリ内容を覗き見される可能性があり、情報漏洩が発生しました。
F5 BIG-IPの構成で、特定のエンドポイントを通じての認証バイパスが可能になる脆弱性。
If this happens at your company Expected impact per business scenario
攻撃者がデータベースに不正アクセスし、顧客データの漏洩や改ざんが発生する可能性がある。
取引データの削除や改ざんが行われ、経済的損失を被るリスクがある。
リアルタイムの監視データが操作され、サービス障害を引き起こす可能性がある。
OpenC3 COSMOSの最新バージョンへ更新し、ユーザー入力の無害化を徹底すること
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'sqli' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
sqliを grep し、稼働しているサービス・バージョンを把握する。 -
7Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com