CVE-2024-5827
Published: 28 June 2024
Summary
CVE-2024-5827 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 2.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Vanna v0.3.4 is affected by a SQL injection vulnerability (CWE-89) in its DuckDB integration when exposed through Flask Web APIs. The flaw carries a CVSS 3.0 base score of 9.8 reflecting network attackability without authentication or user interaction.
An unauthenticated remote attacker can inject malicious SQL training data and issue corresponding queries that write arbitrary files to the victim filesystem, such as a PHP web shell containing system command execution payloads, thereby achieving remote code execution or persistent backdoor access.
The EPSS score stands at 0.3986 with an identical recorded peak, indicating moderate exploitation interest but no material post-disclosure climb. No mitigation guidance or patch details are supplied in the available references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-46973
Vulnerability details
Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php…
more
with contents `<?php system($_GET[0]); ?>`. This can lead to command execution or the creation of backdoors.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.