Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2023-30605— Multiple SQL injections in sql/instance.py param_edit method in Archery - GHSL-2022-104

Quick assessment

Affected
hhyo Archery
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Archery是一套开源的漏洞评估和管理工具。 Archery 存在SQL注入漏洞，该漏洞源于包含多个 SQL 注入漏洞，可能允许攻击者查询连接的数据库。

CVSS 6.5 · Medium EPSS 0.84% · P55
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-30605

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Multiple SQL injections in sql/instance.py param_edit method in Archery - GHSL-2022-104
Source: CVE Program / CVE List V5
Vulnerability Description
Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases. User input coming from the `variable_name` and `variable_value` parameter value in the `sql/instance.py` `param_edit` endpoint is passed to a set of methods in given SQL engine implementations, which concatenate user input unsafely into a SQL query and afterwards pass it to the `query` method of each database engine for execution. The affected methods are: `set_variable` in `sql/engines/goinception.py` which concatenates input which is passed to execution on the database in the `sql/engines/goinception.py`, `get_variables` in `sql/engines/goinception.py` which concatenates input which is passed to execution on the database in the `sql/engines/goinception.py`, `set_variable` in `sql/engines/mysql.py` which concatenates input which is passed to execution on the database in the `sql/engines/mysql.py` `query`, and `get_variables` in `sql/engines/mysql.py`which concatenates input which is passed to execution on the database in the `sql/engines/mysql.py` `query`. Each of these issues may be mitigated by escaping user input or by using prepared statements when executing SQL queries. This advisory is also indexed as `GHSL-2022-104`.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Archery SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Archery是一套开源的漏洞评估和管理工具。 Archery 存在SQL注入漏洞，该漏洞源于包含多个 SQL 注入漏洞，可能允许攻击者查询连接的数据库。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
hhyo Archery <= 1.9.0 -

II. Public POCs for CVE-2023-30605

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-30605

请登录查看更多情报信息。

Vendor Advisories for CVE-2023-30605 (1)

Other References for CVE-2023-30605 (1)

Same Patch Batch · hhyo · 2023-04-18 · 8 CVEs total

CVE-2023-30558 6.5 MEDIUM Multiple SQL injections in sql/data_dictionary.py table_list method in Archery - GHSL-2022
CVE-2023-30552 6.5 MEDIUM SQL injection in sql/instance.py endpoint in Archery - GHSL-2022-101
CVE-2023-30553 6.5 MEDIUM Multiple SQL injections in sql_api/api_workflow.py endpoint in Archery - GHSL-2022-102
CVE-2023-30554 6.5 MEDIUM SQL injection in sql_api/api_workflow.py endpoint in Archery - GHSL-2022-103
CVE-2023-30555 6.5 MEDIUM SQL injection in sql_optimize.py explain method in Archery - GHSL-2022-108
CVE-2023-30556 6.5 MEDIUM SQL injection in sql_optimize.py optimize_sqltuningadvisor method in Archery - GHSL-2022-1
CVE-2023-30557 6.5 MEDIUM SQL injection in data_dictionary.py table_info method in Archery - GHSL-2022-106

IV. Related Vulnerabilities

Same product: Archery
Same vendor: hhyo
Same weakness: CWE-89

V. Comments for CVE-2023-30605

Anonymous User
2026-01-15 06:09:28

Zaproxy alias impedit expedita quisquam pariatur exercitationem. Nemo rerum eveniet dolores rem quia dignissimos.

Leave a comment