| शीर्षक | grit42 grit v0.8.0 through v0.11.0 SQL Injection |
|---|
| विवरण | The Grit::Assays::DataTableEntity model interpolates user-controlled params[:data_table_id] directly into a Rails .joins(string) clause. The model is protected by entity_crud_with read: [], allowing any active grit user (including zero-role accounts) to reach the sink. A preceding DataTable.find(params[:data_table_id]) call coerces the value via to_i, so a payload like 1 OR 1=1 passes .find() but is interpolated unchanged into the JOIN, enabling subquery-based blind extraction.
A zero-role authenticated attacker extracts the administrator's single_access_token from grit_core_users via boolean-blind brute force, then replays it as a permanent Authorization: Bearer credential for full administrator account takeover. The same primitive reads any column the database role can see, including hashed passwords, password-reset tokens, activation tokens, and second-factor tokens. |
|---|
| स्रोत | ⚠️ https://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/SQL%20Injection%20in%20grit42%20Data%20Table%20Entity%20Endpoint |
|---|
| उपयोगकर्ता | Anonymous User |
|---|
| सबमिशन | 16/05/2026 07:18 PM (5 महीनों पहले) |
|---|
| संयम | 14/06/2026 02:19 PM (29 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 370848 [Grit42 Grit तक 0.11.0 data_table_entity.rb DataTableEntity SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|