CyberRota Analysis
AI-GeneratedMagistrala versions prior to 1.0.0 are vulnerable to a SQL injection flaw in the timescale-reader and postgres-reader HTTP API services, allowing authenticated attackers to inject arbitrary SQL through a maliciously crafted query parameter. This vulnerability enables attackers to perform cross-tenant database reads, extract sensitive password hashes, manipulate files, and execute arbitrary code with superuser privileges. Organizations using affected versions should prioritize remediation, particularly those with multi-tenant environments or sensitive data managed through PostgreSQL.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without parameterization or identifier quoting. Attackers with a self-registered account can substitute arbitrary subqueries to achieve cross-tenant database reads, extract pg_shadow password hashes, read and write arbitrary files, and execute arbitrary code as the postgres OS user by loading attacker-supplied shared objects, with all injected SQL executing at superuser privilege due to the default PostgreSQL role configuration.