CVE-2023-28424

CVE-2023-28424 concerns Gentoo Soko, a Go module powering packages.gentoo.org. The vulnerability affects the package search handlers in Go code (pkg/app/handler/packages/search.go) prior to version 1.0.2, where the parameter q enabled a SQL injection. This allowed unauthenticated attackers to run...

CVE-2023-28424 Soko SQL Injection vulnerability

Soko if the code that powers packages.gentoo.org. Prior to version 1.0.2, the two package search handlers, Search and SearchFeed, implemented in pkg/app/handler/packages/search.go, are affected by a SQL injection via the q parameter. As a result, unauthenticated attackers can execute arbitrary SQ...