| 제목 | grit42 grit v0.8.0 through v0.11.0 SQL Injection |
|---|
| 설명 | The Grit::Assays::DataTableEntity model interpolates user-controlled params[:data_table_id] directly into a Rails .joins(string) clause. The model is protected by entity_crud_with read: [], allowing any active grit user (including zero-role accounts) to reach the sink. A preceding DataTable.find(params[:data_table_id]) call coerces the value via to_i, so a payload like 1 OR 1=1 passes .find() but is interpolated unchanged into the JOIN, enabling subquery-based blind extraction.
A zero-role authenticated attacker extracts the administrator's single_access_token from grit_core_users via boolean-blind brute force, then replays it as a permanent Authorization: Bearer credential for full administrator account takeover. The same primitive reads any column the database role can see, including hashed passwords, password-reset tokens, activation tokens, and second-factor tokens. |
|---|
| 원천 | ⚠️ https://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/SQL%20Injection%20in%20grit42%20Data%20Table%20Entity%20Endpoint |
|---|
| 사용자 | Anonymous User |
|---|
| 제출 | 2026. 05. 16. PM 07:18 (3 개월 ago) |
|---|
| 모더레이션 | 2026. 06. 14. PM 02:19 (29 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 370848 [Grit42 Grit 까지 0.11.0 data_table_entity.rb DataTableEntity SQL 주입] |
|---|
| 포인트들 | 20 |
|---|