CyberRota Analysis
AI-GeneratedDify versions prior to 1.16.0-rc1 are vulnerable to a SQL injection flaw in the MyScale vector store backend, enabling attackers to execute arbitrary SQL commands via unsanitized search parameters in the search_by_full_text method. This vulnerability allows for unauthorized access to the underlying ClickHouse database, potentially leading to data reading, modification, or deletion. Organizations using affected versions should prioritize patching to mitigate the risk of data breaches and unauthorized data manipulation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.
Related CVEs
Other vulnerabilities affecting the same vendor(s)