| शीर्षक | onyx-dot-app onyx 0.29.1 SQL Injection |
|---|
| विवरण | This report demonstrates a critical SQL injection vulnerability within the Onyx system. An attacker can send a specially crafted message through the application's chat interface (/api/send-message), which is then routed by the backend agent's tool selector (choose_tool.py) to the vulnerable Knowledge Graph query tool (generate_simple_sql). This tool fails to properly sanitize user input when generating and executing SQL queries, allowing an attacker to inject and execute arbitrary SQL code. This can lead to the theft of sensitive database information, such as user credentials. |
|---|
| स्रोत | ⚠️ https://www.cnblogs.com/aibot/p/18982747 |
|---|
| उपयोगकर्ता | Anonymous User |
|---|
| सबमिशन | 13/07/2025 02:02 PM (1 वर्ष पहले) |
|---|
| संयम | 19/07/2025 01:06 PM (6 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 317009 [Onyx तक 0.29.1 Chat Interface a3_generate_simple_sql.py generate_simple_sql SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|