Listen to this Post
How the CVE Works
OpenMetadata versions <=1.4.4 contain a SQL injection vulnerability in the `listCount` function within the DocStoreDAO interface. The flaw occurs when user-supplied input through the `entityType` parameter is directly incorporated into SQL queries without proper sanitization. Attackers can craft malicious input containing SQL commands that get executed on the backend database. This allows unauthorized data extraction, modification, or deletion. The vulnerability is particularly dangerous as it can be exploited through normal API calls without requiring elevated privileges.
DailyCVE Form
Platform: OpenMetadata
Version: <=1.4.4
Vulnerability: SQL Injection
Severity: Critical
Date: 08/08/2025
Prediction: Patch by 09/15/2025
What Undercode Say
SELECT FROM doc_store WHERE entityType = 'malicious_payload'; UPDATE doc_store SET metadata = 'compromised' WHERE 1=1; DROP TABLE doc_store;
How Exploit
GET /api/v1/docstore/count?entityType=user'%3B+DROP+TABLE+users%3B-- POST /api/v1/docstore/list with crafted entityType
Protection from this CVE
- Upgrade to patched version
- Parameterized queries
- Input validation
Impact
- Data leakage
- Database manipulation
- System compromise
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
