CyberRota Analysis
AI-GeneratedThe vulnerability affects the message-readers API of Magistrala, allowing authenticated users to exploit improper validation of the `format` parameter in HTTP queries. This flaw enables SQL injection attacks, which could lead to unauthorized data access or manipulation in both PostgreSQL and TimescaleDB databases. Organizations using this API should prioritize patching to mitigate the risk of potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Magistrala (formerly Mainflux)'s message-readers API reads a value from the HTTP query string (readers/api/http/transport.go) with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader (readers/postgres/messages.go: ) and the TimescaleDB reader (readers/timescale/messages.go, same pattern), enabling SQL injection by any authenticated user able to query channel messages.