CyberRota Analysis
AI-GeneratedSnipe-IT versions prior to 8.7.0 are vulnerable to arbitrary OS command execution due to improper handling of SQL entries from uploaded backup archives, allowing authenticated superadministrators to execute malicious commands via crafted ZIP files. This vulnerability can lead to exposure of sensitive application secrets, including database credentials, and unauthorized modifications to application files. Organizations using affected versions should prioritize patching to version 8.7.0 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as `\!` as local shell commands. An authenticated superadministrator who uploads a crafted ZIP backup (POST /admin/backups/upload) and triggers a restore (POST /admin/backups/restore/{filename}) without the optional `clean` sanitizer parameter — which is not applied by default because DB_SANITIZE_BY_DEFAULT is false — can execute arbitrary OS commands as the web application's operating-system user, exposing application secrets (including database credentials and APP_KEY) and allowing modification of application-writable files and data. Version 8.7.0 adds the --binary-mode flag to the client invocation.
Related CVEs
Other vulnerabilities affecting the same vendor(s)