CVE-2024-7099: critical vulnerability in netease-youdao/qanything
SQL Injection in netease-youdao/qanything
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 0.6%
netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include `get_knowledge_base_name`, `from_status_to_status`, `delete_files`, and `get_file_by_status`. An attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially stealing information from the database. The issue is fixed in version 1.4.2.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
netease-youdao · netease-youdao/qanythingRelated CVEs — netease-youdao/qanything
In the same product, most dangerous first.
CVE-2024-12866HIGHLocal File Inclusion in netease-youdao/qanythingEPSS 1.5%CVE-2024-10264HIGHHTTP Request Smuggling in netease-youdao/qanythingEPSS 1.0%CVE-2024-12864HIGHUnauthenticated DoS by Sending Large Filename at File Upload Endpoint in netease-youdao/qanythingEPSS 0.9%CVE-2024-8027MEDIUMStored Cross-Site Scripting (XSS) in netease-youdao/QAnythingEPSS 0.4%CVE-2024-8024HIGHCORS Misconfiguration in netease-youdao/qanythingEPSS 0.3%CVE-2024-8026HIGHCSRF due to overly permissive CORS headers in netease-youdao/qanythingEPSS 0.2%