CyberRota Analysis
AI-GeneratedThe Grav CMS database plugin is vulnerable due to the PDO::tableExists method directly interpolating unsanitized table names into SQL queries, which can lead to arbitrary SQL execution. This vulnerability poses a significant risk to the integrity and confidentiality of the database, making it critical for users of Grav CMS and developers utilizing this plugin to upgrade to version 1.2.0 immediately to mitigate potential exploitation. Organizations relying on this plugin should prioritize patching to safeguard their database systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists method interpolates its table argument directly into a raw SQL query string without sanitization, escaping, quoting, or whitelisting, allowing attacker-controlled table names passed by consuming plugin or developer code to execute arbitrary SQL against the configured database. This issue is fixed in version 1.2.0.