Kritik CVSS 9.8
CVE-2026-54349: Chartbrew: SQL Enjeksiyonu Açığı (CVE-2026-54349)
Chartbrew, kullanıcı girdisiyle SQL sorgularını manipüle etmeye izin veriyor. Saldırgan verileri okuyabilir, değiştirebilir veya silebilir. Hemen 5.2.1 sürümüne güncelleyin.
Türkçe özet yapay zekâ ile üretildi.
Açıklama (NVD)
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.1, SQL dashboard-variable substitution used attacker-controlled JavaScript replacement strings unsafely across SQL connectors and separately failed to escape backslashes for MySQL and MariaDB quoted contexts. The vulnerable surface is public and embedded dashboard/chart requests that call applyMysqlOrPostgresVariables. An unauthenticated user sends crafted URL filter values to a public or embedded chart backed by a stored SQL query. Replacement-string dollar sequences can alter SQL independently of the database engine, while MySQL and MariaDB backslash handling provides a second quoted-string escape path. The target must expose a public or embedded chart using URL-controlled variables in a SQL query; only the backslash branch is specific to MySQL and MariaDB. Injected SQL can read, modify, or delete data available to the configured database account. This issue is fixed in version 5.2.1.
Özet bilgiler
- CVSS v3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CWE
- CWE-89
- Yama
- Yok / bilinmiyor