Listen to this Post
How the CVE Works
The vulnerability exists in pyLoad’s `/json/add_package` API endpoint, where the `add_links` parameter is improperly sanitized before being used in an SQL query. The `update_link_info` function in `file_database.py` constructs an SQL query by directly interpolating user-supplied input (statuses) into the query string. This allows an attacker to inject malicious SQL commands, such as `DROP TABLE` or UNION-based data exfiltration. The lack of prepared statements or input validation enables arbitrary SQL execution under the database user’s privileges, leading to data manipulation or destruction.
DailyCVE Form
Platform: pyLoad
Version: <= 0.5.0
Vulnerability: SQL Injection
Severity: Critical
Date: 2023-01-05
Prediction: Patch by 2023-02-15
What Undercode Say
Exploitable SQL query construction
self.c.execute(f"SELECT id FROM links WHERE url IN ('{statuses}')")
Remediation: Parameterized query
placeholders = ','.join(['?'] len(urls))
query = f"SELECT id FROM links WHERE url IN ({placeholders})"
self.c.execute(query, urls)
How Exploit
PoC: Malicious payload in add_links
data = {
"add_links": "https://example.com') OR 1=1; DROP TABLE links;--",
...
}
requests.post("http://target/json/add_package", data=data)
Protection from this CVE
- Use parameterized queries.
- Sanitize user input.
- Update to patched version.
Impact
- Data deletion/modification.
- Unauthorized database access.
- System compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
