Daily Digest
The most urgent item in today's digest is CVE-2024-58385 (CVSS 9.8 CRITICAL), an unauthenticated SQL injection in Yonyou U8 CRM that can lead to arbitrary command execution on Microsoft SQL Server deployments when `xp_cmdshell` is enabled, with exploitation evidence observed since February 2025. While no CISA KEV-confirmed entries appear in this dataset, this 9.8-score critical vulnerability outranks all others by severity and has confirmed in-the-wild exploitation. Healthcare environments running Yonyou U8 CRM backed by SQL Server should prioritize patching immediately, as the flaw requires no authentication and can result in full OS-level compromise.
Summary: Anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting `ATTACH DATABASE` filesystem targets. A remote attacker can cause SQLite to create a database file at any path writable by the Anyquery process and place attacker-controlled table content there, enabling arbitrary file creation or overwrite, filesystem integrity loss, and denial of service. Remote code execution is possible only when another service interprets the written file or the process has a suitably privileged writable target.
Affected Features / Interoperability: The MySQL-compatible server port and SQLite `ATTACH DATABASE` functionality. Downstream integrations that rely on Anyquery as a SQL query gateway could experience data corruption or service disruption. Client drivers connecting via the MySQL wire protocol are affected.
Source:
Actions:
Summary: Anyquery server exposes URL-capable SQLite virtual table modules such as `json_reader` and `log_reader` through its unauthenticated MySQL-compatible server port without restricting outbound destinations. A remote attacker can provide a loopback, private-network, or link-local cloud metadata URL, causing `go-getter` in the Anyquery server process to fetch the selected resource and expose its response as queryable table data, enabling internal network probing, access to internal APIs, and disclosure of cloud credentials.
Affected Features / Interoperability: SQLite virtual table modules (`json_reader`, `log_reader`) and the `go-getter` HTTP client within the Anyquery server process. Downstream functionality affected includes any integration relying on these virtual tables for data ingestion. Cloud metadata endpoints and internal APIs reachable from the server process are at risk of being probed or exfiltrated.
Source:
Actions:
Summary: SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted `annee` parameter value matching a word character followed by an open parenthesis, which bypasses escaping for date-type columns across MySQL, SQLite, and PostgreSQL backends. Attackers can exploit the always-present `sitemap.xml.html` template's `annee` criterion to embed unescaped time-based or boolean payloads into database queries, enabling extraction of arbitrary database content including the `alea_ephemere` secret used to sign SPIP action nonces.
Affected Features / Interoperability: The SPIP SQL escaping layer and the `sitemap.xml.html` template's `annee` criterion. Affects MySQL, SQLite, and PostgreSQL backends. Downstream functionality impacted includes SPIP's authentication nonce system, potentially allowing session forgery. Any SPIP installation with the sitemap template active is reachable.
Source:
Actions:
Summary: A privilege escalation flaw exists in the `scan_mysql` actor of `leapp-upgrade-el9toel10`. During RHEL 9 to RHEL 10 upgrades, the actor runs `mysqld --validate-config --log-error-verbosity=2` directly as root in the Leapp actor context, bypassing the packaged MySQL systemd unit that normally starts the daemon as `User=mysql`. A process compromised as the mysql OS identity can write a malicious `mysqld-auto.cnf` and shared object into `/var/lib/mysql`, setting `plugin_dir` and `early_plugin_load` so MySQL loads the attacker-controlled object during configuration validation, executing code as UID 0 in an unconfined SELinux domain.
Affected Features / Interoperability: The `leapp-upgrade-el9toel10` migration tool's `scan_mysql` actor and MySQL's plugin loading mechanism (`mysqld-auto.cnf`, `plugin_dir`, `early_plugin_load`). Downstream functionality impacted includes RHEL 9-to-10 upgrade workflows that use Leapp. MySQL plugin loading and configuration validation are compromised. Ordinary SQL privileges alone are not sufficient — OS-level execution as the mysql service identity plus administrator invocation of Leapp is required.
Source:
Actions:
Summary: Prior to versions 6.6.16 and 7.1.7, MikroORM's shared SQL layer validates the field key of an `orderBy` clause but does not validate its direction value before concatenating it into an `ORDER BY` clause. Applications that bind attacker-controlled request data to the direction parameter in `em.find()`, `em.findOne()`, `em.findAndCount()`, `QueryBuilder.orderBy()`, or `QueryBuilderHelper.getQueryOrderFromObject()` can permit a raw SQL fragment that performs blind or boolean extraction of data available to the database account. Affects SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, and Oracle drivers; MongoDB is not affected.
Affected Features / Interoperability: MikroORM's `orderBy` direction parameter handling across the BaseMySqlPlatform, MsSqlPlatform, and all affected SQL drivers. Downstream functionality impacted includes any application using MikroORM's query builder with user-controlled sort directions. Client drivers for PostgreSQL, MySQL, MariaDB, MSSQL, SQLite, libSQL, and Oracle are all affected.
Source:
Actions:
Summary: Affected versions of MISP incorrectly filter dashboard templates restricted to a specific permission flag due to MySQL numeric coercion. `restrict_to_permission_flag` is a varchar column, and MySQL performs numeric coercion when comparing against integer 0, causing strings like `perm_site_admin` to convert numerically to zero and match the unrestricted branch. This allows permission-restricted templates to be accessed. Affected version: ≤2.5.45.
Affected Features / Interoperability: MISP's `DashboardsController::listTemplates()` permission filtering and MySQL numeric coercion behavior. Downstream functionality impacted includes dashboard template access control — templates intended to be restricted to specific permission flags may be incorrectly exposed to users who should not have access.
Source:
Actions:
---
Summary: Magistrala before 1.0.0 contains a SQL injection vulnerability in the `timescale-reader` and `postgres-reader` HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious `format` query parameter interpolated directly into the `FROM` clause without parameterization or identifier quoting. Attackers with a self-registered account can substitute arbitrary subqueries to achieve cross-tenant database reads, extract `pg_shadow` password hashes, read and write arbitrary files, and execute arbitrary code as the postgres OS user by loading attacker-supplied shared objects, with all injected SQL executing at superuser privilege due to the default PostgreSQL role configuration.
Affected Features / Interoperability: The `timescale-reader` and `postgres-reader` HTTP API services and their `format` query parameter handling. Downstream functionality impacted includes multi-tenant data isolation (cross-tenant reads), PostgreSQL authentication (`pg_shadow`), filesystem integrity, and OS-level security via the postgres superuser account. Any Magistrala deployment using default PostgreSQL role configuration is fully exposed.
Source:
Actions:
Summary: SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted `annee` parameter value matching a word character followed by an open parenthesis, which bypasses escaping for date-type columns across MySQL, SQLite, and PostgreSQL backends. Attackers can exploit the always-present `sitemap.xml.html` template's `annee` criterion to embed unescaped time-based or boolean payloads into database queries, enabling extraction of arbitrary database content including the `alea_ephemere` secret used to sign SPIP action nonces.
Affected Features / Interoperability: The SPIP SQL escaping layer and the `sitemap.xml.html` template's `annee` criterion, specifically affecting PostgreSQL (among other backends). Downstream functionality impacted includes SPIP's authentication nonce system and any PostgreSQL-backed SPIP installation with the sitemap template active.
Source:
Actions:
Summary: Prior to versions 6.6.16 and 7.1.7, MikroORM's shared SQL layer validates the field key of an `orderBy` clause but does not validate its direction value before concatenating it into an `ORDER BY` clause. Applications that bind attacker-controlled request data to the direction parameter in `em.find()`, `em.findOne()`, `em.findAndCount()`, `QueryBuilder.orderBy()`, or `QueryBuilderHelper.getQueryOrderFromObject()` can permit a raw SQL fragment that performs blind or boolean extraction of data available to the database account. Affects SQLite, PostgreSQL, MySQL, MariaDB, MSSQL, libSQL, and Oracle drivers; MongoDB is not affected.
Affected Features / Interoperability: MikroORM's `orderBy` direction parameter handling across all affected SQL drivers including PostgreSQL. Downstream functionality impacted includes any application using MikroORM's query builder with user-controlled sort directions against PostgreSQL databases.
Source:
Actions:
---
Summary: Vulnerability in the RDBMS component of Oracle Database Server affecting versions 23.4.0-23.26.3. Easily exploitable vulnerability allows a low-privileged attacker with Create Table privilege and network access via Oracle Net to compromise the RDBMS, potentially resulting in takeover of the RDBMS.
Affected Features / Interoperability: Oracle Database RDBMS component. Any functionality accessible via Oracle Net that requires Create Table privilege is affected. Downstream integrations using Oracle Net connectivity may be at risk.
Source:
Actions:
Summary: Vulnerability in the RDBMS component of Oracle Database Server affecting versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. Easily exploitable vulnerability allows a low-privileged attacker with Execute on DBMS_REDEFINITION privilege and network access via Oracle Net to compromise the RDBMS, potentially resulting in takeover.
Affected Features / Interoperability: Oracle Database RDBMS component and the `DBMS_REDEFINITION` package. Downstream functionality impacted includes any online redefinition operations and applications that grant Execute on `DBMS_REDEFINITION` to low-privileged accounts.
Source:
Actions:
Summary: Vulnerability in the RDBMS component of Oracle Database Server affecting versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. Easily exploitable vulnerability allows a low-privileged attacker with Create DB Link privilege and network access via Oracle Net to compromise the RDBMS, potentially resulting in takeover.
Affected Features / Interoperability: Oracle Database RDBMS component and database link creation functionality. Downstream integrations relying on database links for distributed queries or data replication are affected.
Source:
Actions:
Summary: Vulnerability in the Oracle Text component of Oracle Database Server affecting versions 19.3-19.32, 21.3-21.23, and 23.4.0-23.26.3. Difficult to exploit vulnerability allows a low-privileged attacker with Create Index privilege and network access via Oracle Net to compromise Oracle Text, potentially resulting in takeover of Oracle Text. Attacks may significantly impact additional products (scope change).
Affected Features / Interoperability: Oracle Text component and index creation functionality. Downstream functionality impacted includes text indexing, search, and any Oracle Text-dependent applications. The scope change means additional products may also be affected.
Source:
Actions:
Summary: Vulnerability in the RDBMS component of Oracle Database Server affecting versions 23.4.0-23.26.3. Difficult to exploit vulnerability allows an unauthenticated attacker with network access via Oracle Net to compromise the RDBMS, potentially resulting in takeover.
Affected Features / Interoperability: Oracle Database RDBMS component. Unlike other entries in this batch, this vulnerability does not require a specific privilege — it is exploitable by unauthenticated attackers with network access via Oracle Net. Any Oracle Net-exposed instance running affected versions is at risk.
Source:
Actions:
Summary: Vulnerability in the Core component of Oracle Enterprise Manager for Oracle Database, version 24.1 affected. Easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Enterprise Manager, potentially resulting in unauthorized access to critical data or complete access to all accessible data. Attacks may significantly impact additional products (scope change).
Affected Features / Interoperability: Oracle Enterprise Manager for Oracle Database (version 24.1) and its Core component. Downstream functionality impacted includes all monitoring, management, and configuration operations performed through Enterprise Manager. The scope change means additional products managed by Enterprise Manager may also be affected.
Source:
Actions:
Summary: Vulnerability in the RDBMS
User Safety: safe