| tiêu đề | grit42 grit v0.8.0 through v0.11.0 SQL Injection |
|---|
| Mô tả | The Grit::Assays::DataTableEntity model interpolates user-controlled params[:data_table_id] directly into a Rails .joins(string) clause. The model is protected by entity_crud_with read: [], allowing any active grit user (including zero-role accounts) to reach the sink. A preceding DataTable.find(params[:data_table_id]) call coerces the value via to_i, so a payload like 1 OR 1=1 passes .find() but is interpolated unchanged into the JOIN, enabling subquery-based blind extraction.
A zero-role authenticated attacker extracts the administrator's single_access_token from grit_core_users via boolean-blind brute force, then replays it as a permanent Authorization: Bearer credential for full administrator account takeover. The same primitive reads any column the database role can see, including hashed passwords, password-reset tokens, activation tokens, and second-factor tokens. |
|---|
| Nguồn | ⚠️ https://github.com/natanmorette-thoropass/thoropass-vuln-research-program/tree/main/2026/SQL%20Injection%20in%20grit42%20Data%20Table%20Entity%20Endpoint |
|---|
| Người dùng | Anonymous User |
|---|
| Đệ trình | 16/05/2026 19:18 (cách đây 3 các tháng) |
|---|
| Kiểm duyệt | 14/06/2026 14:19 (29 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 370848 [Grit42 Grit đến 0.11.0 data_table_entity.rb DataTableEntity Tiêm SQL] |
|---|
| điểm | 20 |
|---|