CyberRota Analysis
AI-GeneratedDbGate versions 7.1.8 and earlier are vulnerable to remote code execution due to improper handling of the `functionName` parameter in JSON script `assign` commands, allowing attackers to inject malicious code. This critical vulnerability can lead to unauthorized execution of arbitrary code on the server, potentially compromising sensitive data and system integrity. Organizations using affected versions of DbGate should prioritize immediate updates to version 7.1.9 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parameter of JSON script `assign` commands. The `functionName` value is interpolated directly into dynamically generated JavaScript source code via string concatenation. The generated code is then executed in a forked Node.js child process. Version 7.1.9 contains a patch.