漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
MobSF has SQL Injection in its SQLite Database Viewer Utils
Vulnerability Description
MobSF is a mobile application security testing tool used. Prior to version 4.4.6, MobSF's `read_sqlite()` function in `mobsf/MobSF/utils.py` (lines 542-566) uses Python string formatting (`%`) to construct SQL queries with table names read from a SQLite database's `sqlite_master` table. When a security analyst uses MobSF to analyze a malicious mobile application containing a crafted SQLite database, attacker-controlled table names are interpolated directly into SQL queries without parameterization or escaping. This allows an attacker to cause denial of service and achieve SQL injection. Version 4.4.6 patches the issue.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Vulnerability Title
Mobile Security Framework SQL注入漏洞
Vulnerability Description
Mobile Security Framework（MobSF）是Mobile Security Framework开源的一种自动化的一体化移动应用程序。用于渗透测试、恶意软件分析和安全评估，能够执行静态和动态分析。 Mobile Security Framework 4.4.6之前版本存在SQL注入漏洞，该漏洞源于read_sqlite函数使用Python字符串格式化构造SQL查询，可能导致拒绝服务和SQL注入攻击。
CVSS Information
N/A
Vulnerability Type
N/A