PT-2024-38074 · Netease Youdao · Qanything

Published 2024-10-13 · Updated 2024-10-15 · CVE-2024-7099

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions netease-youdao/qanything version 1.4.1

Description The issue concerns a SQL injection vulnerability where unsafe data obtained from user input is concatenated in SQL queries. This affects functions including get knowledge base name, from status to status, delete files, and get file by status. An attacker can exploit this to execute arbitrary SQL queries, potentially stealing database information.

Recommendations To resolve the issue, update to version 1.4.2. As a temporary workaround, consider restricting the use of the affected functions until the update is applied. Avoid using user input in SQL queries without proper sanitization to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-7099

Affected Products

Qanything

References · 11

• 🔥 https://huntr.com/bounties/bc98983e-06cc-4a4b-be01-67e5010cb2c1 · Exploit
• https://github.com/netease-youdao/qanything/commit/a87354f09d93e95350fb45eb343dc75454387554 · Patch
• https://osv.dev/vulnerability/CVE-2024-7099 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7099 · Security Note
• https://twitter.com/CveFindCom/status/1845578083597767127 · Twitter Post
• https://twitter.com/CVEnew/status/1845577628398604441 · Twitter Post
• https://twitter.com/SecPod/status/1845724577118175603 · Twitter Post
• https://twitter.com/vuldb/status/1845695542032244870 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1845594517811941454 · Twitter Post
• https://t.me/cvenotify/97958 · Telegram Post
• https://t.me/cvedetector/7794 · Telegram Post