PT-2023-30331 · Piccolo · Piccolo
Skelmis
·
Published
2023-11-10
·
Updated
2023-11-20
·
CVE-2023-47128
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Piccolo versions prior to 1.1.1
Description
The handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection via f-strings. This could allow a malicious user to have direct access to the database and modify data to the level of permissions associated with the database user. Possible actions based on database permissions include reading all data stored in the database, inserting arbitrary data, and gaining a shell on the underlying server.
Recommendations
For versions prior to 1.1.1, update to version 1.1.1 to fix the issue. As a temporary workaround, consider restricting access to the
savepoint method to minimize the risk of exploitation. Avoid passing user-provided input directly to connection.execute without proper escaping. Ensure all strings passed to connection.execute are properly escaped, regardless of how end-user facing they may be.Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Piccolo