Listen to this Post
The vulnerability in sqls-server/sqls v0.2.28 stems from insecure command execution within the `config` command. The `openEditor` function constructs a shell command to open a configuration file using a user-controlled environment variable, $EDITOR. This variable and the file path are concatenated and passed directly to `sh -c` without any sanitization. An attacker can set the `EDITOR` environment variable to a malicious string containing shell metacharacters. When the `config` command is invoked, the crafted string is executed by the shell with the same privileges as the sqls process, allowing for arbitrary command execution on the host system. The lack of input validation or the use of safe execution functions makes this exploitation trivial.
Platform: sqls-server/sqls
Version: 0.2.28
Vulnerability: Command Injection
Severity: High
date: 2025-10-30
Prediction: Patch expected by 2025-11-06
What Undercode Say:
export EDITOR='vim; id ' sqls config
// Vulnerable code in openEditor function
cmd := exec.Command("sh", "-c", os.Getenv("EDITOR")+" "+configPath)
How Exploit:
Set malicious EDITOR variable.
Execute `sqls config`.
Arbitrary commands run.
Protection from this CVE
Update to patched version.
Sanitize EDITOR variable.
Use exec.Command directly.
Impact:
Arbitrary Command Execution
Host System Compromise
Privilege Escalation
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
