clidey whodb prior 0.45.0 allowAllFiles data query logic injection

Summaryinfo

A vulnerability, which was classified as problematic, has been found in clidey whodb. The affected element is an unknown function. This manipulation of the argument allowAllFiles causes data query logic injection. This vulnerability appears as CVE-2025-24787. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in clidey whodb. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument allowAllFiles with an unknown input leads to a data query logic injection vulnerability. The CWE definition for the vulnerability is CWE-943. The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query. As an impact it is known to affect confidentiality. The summary by CVE is:

WhoDB is an open source database management tool. In affected versions the application is vulnerable to parameter injection in database connection strings, which allows an attacker to read local files on the machine the application is running on. The application uses string concatenation to build database connection URIs which are then passed to corresponding libraries responsible for setting up the database connections. This string concatenation is done unsafely and without escaping or encoding the user input. This allows an user, in many cases, to inject arbitrary parameters into the URI string. These parameters can be potentially dangerous depending on the libraries used. One of these dangerous parameters is `allowAllFiles` in the library `github.com/go-sql-driver/mysql`. Should this be set to `true`, the library enables running the `LOAD DATA LOCAL INFILE` query on any file on the host machine (in this case, the machine that WhoDB is running on). By injecting `&allowAllFiles=true` into the connection URI and connecting to any MySQL server (such as an attacker-controlled one), the attacker is able to read local files. This issue has been addressed in version 0.45.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2025-24787 since 01/23/2025. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 216199 (SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2025:0429-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 0.45.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (216199). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• clidey

Name

• whodb

Website

• Product: https://github.com/clidey/whodb/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion