AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, a SQL injection vulnerability in the built-in SQL Agent plugin allows any user who can invoke the agent to execute arbitrary SQL commands on connected databases. The getTableSchemaSql() method in all three database connectors (MySQL, PostgreSQL, MSSQL) constructs SQL queries using direct string concatenation of the table_name parameter without sanitization or parameterization.

N/A

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

AnythingLLM SQL注入漏洞

AnythingLLM是Mintplex开源的一个一体化AI应用程序。 AnythingLLM 1.11.1及之前版本存在SQL注入漏洞，该漏洞源于内置SQL代理插件中存在SQL注入漏洞，任何可以调用代理的用户都可能对连接的数据库执行任意SQL命令，三个数据库连接器的getTableSchemaSql方法使用未经清理或参数化的table_name参数直接字符串拼接构造SQL查询。

N/A

N/A