Beveiligingsadvies

CVE-2024-10835

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2025-03-20 10:09:31

Laatst bijgewerkt 2025-03-20 18:37:53

Toegewezen door @huntr_ai

CVSS-score 9.1

Status PUBLISHED

Beschrijving

In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/sql/run` allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write using DuckDB SQL, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE).

← Alle CVE's bekijken Bekijk op cve.org ↗