CyberRota Analysis
AI-GeneratedThe SQL injection vulnerability affects n8n versions prior to 1.123.80 and from 2.0.0 before 2.39.6, as well as from 2.40.0 before 2.40.1, specifically within the Oracle Database node's Delete Table Drop operation. This flaw allows attackers to manipulate SQL statements by injecting single quotes into table or schema fields, potentially executing unauthorized DDL or DML commands with the privileges of the connected database credentials. Organizations using affected n8n versions, particularly those integrating with Oracle databases, should prioritize patching to mitigate the risk of data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle Database node's Delete Table Drop operation. Attackers can inject single quotes in the table or schema fields to append arbitrary SQL statements and execute DDL or DML commands against the connected database with the credential's privileges.