| शीर्षक | CodePhiliaX Chat2DB <=0.3.7 SQL Injection |
|---|
| विवरण | Multiple high-severity SQL Injection vulnerabilities in DMDBManage.java component. When processing database export operations for DM databases (e.g., via /api/rdb/database/export endpoint), the application fails to validate or sanitize user-supplied parameters such as schemaName and tableName. These parameters are directly concatenated into SQL query templates using String.format(). This allows authenticated attackers to inject malicious SQL clauses, bypass schema isolation, and extract table structures, metadata, and sensitive data from other privileged schemas. |
|---|
| स्रोत | ⚠️ https://github.com/AnalogyC0de/public_exp/issues/21 |
|---|
| उपयोगकर्ता | Ana10gy (UID 93358) |
|---|
| सबमिशन | 02/03/2026 04:15 AM (7 महीनों पहले) |
|---|
| संयम | 14/03/2026 04:03 PM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 351080 [CodePhiliaX Chat2DB तक 0.3.7 Database Export DMDBManage.java SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|