Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution
Vulnerability Description
SQLAlchemyDA is a generic database adapter for ZSQL methods. A vulnerability found in versions prior to 2.2 allows unauthenticated execution of arbitrary SQL statements on the database to which the SQLAlchemyDA instance is connected. All users are affected. The problem has been patched in version 2.2. There is no workaround for the problem.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Vulnerability Title
SQLAlchemy SQL注入漏洞
Vulnerability Description
SQLAlchemy是一款基于Python的开源数据库ORM软件。该产品主要提供SQL工具包及对象关系映射工具。 SQLAlchemyDA 2.2 之前版本存在SQL注入漏洞，该漏洞源于允许在 SQLAlchemyDA 实例所连接的数据库上未经身份验证地执行任意 SQL 语句。
CVSS Information
N/A
Vulnerability Type
N/A