PT-2024-13958 · Nocodb · Nocodb

Pyozzi-Toss · Published 2024-05-13 · Updated 2025-08-21 · CVE-2023-50718

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions NocoDB versions prior to 0.202.10

Description The issue allows an authenticated attacker with create access to conduct a SQL Injection attack on MySQL DB using an unescaped table name. This may result in leakage of sensitive data in the database. The SQL Injection vulnerability occurs in the VitessClient.ts file, specifically in the columnList function, where the args.tn variable, referring to the table name entered by the user, is not properly sanitized. A malicious attacker can exploit this by including a special character in the table name to escape the existing query and execute a new arbitrary SQL query.

Recommendations For versions prior to 0.202.10, update to version 0.202.10 or later, which contains a patch for the issue. As a temporary workaround, consider restricting access to the columnList function in VitessClient.ts to minimize the risk of exploitation. Additionally, restrict the use of the args.tn variable in the affected SQL query until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-50718

GHSA-8FXG-MR34-JQR8

Affected Products

Nocodb

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50718.json · Exploit
• https://github.com/nocodb/nocodb/security/advisories/GHSA-8fxg-mr34-jqr8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50718 · Security Note
• https://osv.dev/vulnerability/CVE-2023-50718 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8fxg-mr34-jqr8 · Vendor Advisory
• https://github.com/nocodb/nocodb · Note
• https://t.me/cveNotify/133020 · Telegram Post
• https://twitter.com/CVEnew/status/1790059600349134898 · Twitter Post