mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-06-07 05:28:59 +00:00
60 lines
2.6 KiB
JSON
60 lines
2.6 KiB
JSON
{
|
|
"id": "CVE-2024-7764",
|
|
"sourceIdentifier": "security@huntr.dev",
|
|
"published": "2025-03-20T10:15:36.717",
|
|
"lastModified": "2025-03-20T10:15:36.717",
|
|
"vulnStatus": "Awaiting Analysis",
|
|
"cveTags": [],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Vanna-ai v0.6.2 is vulnerable to SQL Injection due to insufficient protection against injecting additional SQL commands from user requests. The vulnerability occurs when the `generate_sql` function calls `extract_sql` with the LLM response. An attacker can include a semi-colon between a search data field and their own command, causing the `extract_sql` function to remove all LLM generated SQL and execute the attacker's command if it passes the `is_sql_valid` function. This allows the execution of user-defined SQL beyond the expected boundaries, notably the trained schema."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "Vanna-ai v0.6.2 es vulnerable a la inyecci\u00f3n de SQL debido a la protecci\u00f3n insuficiente contra la inyecci\u00f3n de comandos SQL adicionales provenientes de las solicitudes de usuario. La vulnerabilidad se produce cuando la funci\u00f3n `generate_sql` llama a `extract_sql` con la respuesta LLM. Un atacante puede incluir un punto y coma entre un campo de datos de b\u00fasqueda y su propio comando, lo que provoca que la funci\u00f3n `extract_sql` elimine todo el SQL generado por LLM y ejecute el comando del atacante si este pasa la funci\u00f3n `is_sql_valid`. Esto permite la ejecuci\u00f3n de SQL definido por el usuario m\u00e1s all\u00e1 de los l\u00edmites previstos, en particular del esquema entrenado."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV30": [
|
|
{
|
|
"source": "security@huntr.dev",
|
|
"type": "Secondary",
|
|
"cvssData": {
|
|
"version": "3.0",
|
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
|
|
"baseScore": 8.1,
|
|
"baseSeverity": "HIGH",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "LOW",
|
|
"userInteraction": "NONE",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "NONE"
|
|
},
|
|
"exploitabilityScore": 2.8,
|
|
"impactScore": 5.2
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "security@huntr.dev",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-89"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://huntr.com/bounties/85d403b1-fbed-42e9-9ec1-2f79abf6eb0f",
|
|
"source": "security@huntr.dev"
|
|
}
|
|
]
|
|
} |