Description

Archery v1.4.5 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_file, end_file, start_time, and stop_time parameters in the binlog2sql interface.

Related CPE's

a

archerydms

archery

Vulnerable

References

https://announcements.bybit.com/en-US/article/bybit-improves-the-security-of-the-open-source-community-blt626818c0ee8c48a6/

Third Party Advisory

https://github.com/hhyo/Archery/blob/v1.8.5/sql/urls.py#L135

Third Party Advisory

https://github.com/hhyo/Archery/issues/1842

Issue TrackingThird Party Advisory

https://announcements.bybit.com/en-US/article/bybit-improves-the-security-of-the-open-source-community-blt626818c0ee8c48a6/

Third Party Advisory

https://github.com/hhyo/Archery/blob/v1.8.5/sql/urls.py#L135

Third Party Advisory

https://github.com/hhyo/Archery/issues/1842

Issue TrackingThird Party Advisory

Weaknesses

[email protected]

Primary
CWE-89

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 · Critical

Information

Source identifier

[email protected]

Vulnerability status

Modified

Published

2022-09-13T13:15:08.973Z

3 years ago

Last modified

2024-11-21T06:16:38.043Z

1 year ago