CVE-2023-30554

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-30554

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-30554.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-30554

Aliases

GHSA-3p43-89m6-7x5w

Published

2023-04-18T22:35:34.829Z

Modified

2026-07-15T01:49:00.491221933Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

SQL injection in sql_api/api_workflow.py endpoint in Archery - GHSL-2022-103

Details

Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. Affected versions are subject to SQL injection in the sql_api/api_workflow.py endpoint ExecuteCheck which passes unfiltered input to the explain_check method in sql/engines/oracle.py. User input coming from the db_name parameter value in the api_workflow.py ExecuteCheck endpoint is passed through the oracle.py execute_check method and to the explain_check method for execution. Each of these issues may be mitigated by escaping user input or by using prepared statements when executing SQL queries. This issue is also indexed as GHSL-2022-103.

Database specific

{
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/30xxx/CVE-2023-30554.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/hhyo/archery

Affected ranges

Type

GIT

Repo

https://github.com/hhyo/archery

Events

Introduced

bc86cda4c3b7d59f759d0d23bb63a54f52616752

Last affected

bc86cda4c3b7d59f759d0d23bb63a54f52616752

Database specific

{
    "cpe": "cpe:2.3:a:archerydms:archery:1.9.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.9.0"
        },
        {
            "introduced": "1.9.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_STRING"
    ]
}

Affected versions

1.*

1.9.0

v1.*

v1.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-30554.json"