CyberRota Analysis
AI-GeneratedDgraph prior to version 25.3.4 is vulnerable to DQL injection through the `checkUserPassword` GraphQL query, allowing attackers to manipulate user-supplied password values and execute arbitrary DQL queries. This vulnerability poses a high risk as it can lead to unauthorized data access or manipulation. Organizations using affected versions of Dgraph should prioritize upgrading to version 25.3.4 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPassword` GraphQL query in Dgraph is vulnerable to DQL (Dgraph Query Language) injection. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks. Version 25.3.4 patches the issue.