PT-2024-7519 · Unknown · Python-Sql

Cédric Krier · Published 2024-09-24 · Updated 2025-02-07 · CVE-2024-9774

Positive Technologies (AI Summary)

CVSS v2.0

8.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions python-sql (affected versions not specified)

Description A vulnerability was found in python-sql where unary operators do not escape non-Expression, such as And and Or. This makes any system exposing those vulnerable to an SQL injection attack, allowing a remote attacker to execute arbitrary SQL code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-150

CWE-89

CWE-76

Related Identifiers

BDU:2024-08916

CVE-2024-9774

DLA-3932-1

DSA-5795-1

GHSA-PQ9P-PC3P-9HM4

OPENSUSE-SU-2024:0412-1

OPENSUSE-SU-2024:0413-1

Affected Products

Python-Sql

References · 31

• https://osv.dev/vulnerability/UBUNTU-CVE-2024-9774 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-9774 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08916 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:0412-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-9774 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3932-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-9774 · Security Note
• https://osv.dev/vulnerability/GHSA-pq9p-pc3p-9hm4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-9774 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9774 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:0413-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5795-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-9774 · Vendor Advisory
• https://github.com/tryton/python-sql · Note
• https://bugs.tryton.org/python-sql/93 · Note