| عنوان | grit42 grit v0.8.0 through v0.11.0 SQL Injection |
|---|
| الوصف | The Grit::Assays::DataTableEntity model interpolates user-controlled params[:data_table_id] directly into a Rails .joins(string) clause. The model is protected by entity_crud_with read: [], allowing any active grit user (including zero-role accounts) to reach the sink. A preceding DataTable.find(params[:data_table_id]) call coerces the value via to_i, so a payload like 1 OR 1=1 passes .find() but is interpolated unchanged into the JOIN, enabling subquery-based blind extraction.
A zero-role authenticated attacker extracts the administrator's single_access_token from grit_core_users via boolean-blind brute force, then replays it as a permanent Authorization: Bearer credential for full administrator account takeover. The same primitive reads any column the database role can see, including hashed passwords, password-reset tokens, activation tokens, and second-factor tokens. |
|---|
| المصدر | ⚠️ https://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/SQL%20Injection%20in%20grit42%20Data%20Table%20Entity%20Endpoint |
|---|
| المستخدم | Anonymous User |
|---|
| ارسال | 16/05/2026 07:18 PM (4 أشهر منذ) |
|---|
| الاعتدال | 14/06/2026 02:19 PM (29 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 370848 [Grit42 Grit حتى 0.11.0 data_table_entity.rb DataTableEntity حقن SQL] |
|---|
| النقاط | 20 |
|---|