CVE-2024-10835 CRITICAL

CVE-2024-10835: Arbitrary File Write via SQL Injection in eosphoros-ai/db-gpt

Vendor Eosphoros-Ai
Product eosphoros-ai/db-gpt
Weakness CWE-89 · SQLi
Published March 20, 2025
Last update March 20, 2025
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

What the vulnerability does

01Description

In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/sql/run` allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write using DuckDB SQL, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE).

Key dates

02Disclosure timeline

March 20, 2025 CVE published
March 20, 2025 Record updated