GHSA-9QQ5-422F-33C2 Velociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin

Summary The sql VQL plugin runs a caller-supplied database driver and connection string with no permission check vql/parsers/sql/sql.go:93, SQLPlugin.Call. For driver='mysql' or driver='postgres' the handle comes from GetHandleOther sql.go:39, which passes the connection string straight to Go...