CVE-2024-7099 CRITICAL

CVE-2024-7099: SQL Injection in netease-youdao/qanything

Vendor Netease-Youdao
Product netease-youdao/qanything
Weakness CWE-89 · SQLi
Published October 13, 2024
Last update October 15, 2024
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include `get_knowledge_base_name`, `from_status_to_status`, `delete_files`, and `get_file_by_status`. An attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially stealing information from the database. The issue is fixed in version 1.4.2.

Key dates

02Disclosure timeline

October 13, 2024 CVE published
October 15, 2024 Record updated