CVE-2023-30553

CVE-2023-30553 affects Archery, an open-source SQL audit platform, containing multiple SQL injection vulnerabilities in the sql_api/api_workflow.py ExecuteCheck endpoint. User input from db_name and full_sql in ExecuteCheck is concatenated into SQL queries by vulnerable code paths in sql/engines/...

CVE-2023-30555

CVE-2023-30555 concerns Archery, an open-source SQL audit platform, with multiple SQL injection vulnerabilities in the explain endpoint. The root cause is that user input from the db_name parameter is passed to database engine queries (query methods in sql/engines/mssql.py and sql/engines/oracle....

CVE-2022-38540

The vulnerability CVE-2022-38540 affects Archery versions 1.4.0 through 1.8.5 and arises from a SQL injection in the ThreadIDs parameter of the create_kill_session interface. The issue is documented across multiple feeds (NVD/OSV/Red Hat and third-party trackers) with a high impact potential; exp...

CVE-2022-38542

Archery exposes a SQL injection vulnerability in versions 1.4.0 through 1.8.5 via the ThreadIDs parameter in the kill_session interface. The issue, confirmed by multiple sources, is mitigated by upgrading to version 1.9.0 or newer. A temporary workaround suggested by PT-Security is to restrict ac...

CVE-2023-30558

CVE-2023-30558 affects Archery, an open source SQL audit platform. The vulnerability arises from multiple SQL injection flaws in the sql/data_dictionary.py table_list endpoint, where untrusted input from the db_name parameter is concatenated into SQL queries and passed to database engines. Affect...

CVE-2022-38538

Archery v1.7.0–v1.8.5 contains a SQL injection vulnerability in the report module exposed via the checksum parameter. The issue affects versions 1.7.0 through 1.8.5; the underlying cause is a vulnerable handling of the checksum parameter in the report module (no further technical details provided...

CVE-2023-30605

CVE-2023-30605 describes multiple SQL injection vulnerabilities in Archery, an open source SQL audit platform. The issue arises in the sql/instance.py param_edit endpoint, where user input from variable_name and variable_value is concatenated into SQL queries by several engine implementations (no...

CVE-2022-38537

Archery versions 1.4.5–1.8.5 contain multiple SQL injection vulnerabilities via the binlog2sql interface parameters start_file, end_file, start_time, and stop_time. Root cause: improper input handling in the affected interface leading to injection. Impact is high (confidentiality, integrity, avai...

CVE-2023-30552

CVE-2023-30552 concerns Archery, an open source SQL audit platform. The provided documents describe multiple SQL injection vulnerabilities in the Archery project, specifically in the sql/instance.py endpoint’s describe method. The root cause is unsafe concatenation of user input (tb_name, db_name...

CVE-2022-38541

Summary: CVE-2022-38541 affects Archery versions 1.8.3–1.8.5. Multiple SQL injection vulnerabilities are exploitable via the start_time and stop_time parameters in the my2sql interface. The NVD entry lists a critical base score (9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Several connected sources...

CVE-2023-30556

CVE-2023-30556 concerns an SQL injection in Archery, an open source SQL audit platform. The vulnerability affects the function/flow where user input from the db_name parameter in sql_optimize.py is passed to the sqltuningadvisor method in oracle.py, enabling attackers to query connected databases...

CVE-2022-38539

Archery v1.7.5 to v1.8.5 contains a SQL injection in the where parameter of the /archive/apply endpoint. The vulnerability affects the Archery SQL query handling for this API call, with no public details on a fixed version in the provided documents. Exploitation details are not furnished here; no...

CVE-2023-30557

CVE-2023-30557 affects Archery, an open-source SQL audit/management tool. The vulnerability arises from SQL injection in the data_dictionary.py table_info endpoint, where user input from db_name and tb_name is unsafely concatenated into SQL queries and passed to database engines (sql/engines/mssq...

CVE-2023-30554

CVE-2023-30554 affects Archery, an open-source SQL audit platform. The vulnerability concerns multiple SQL injection flaws in the sql_api/api_workflow.py endpoint ExecuteCheck, where unfiltered input from the db_name parameter is passed through to explain_check in sql/engines/oracle.py. This chai...

CVE-2023-48053

CVE-2023-48053 affects Archery v1.10.0, which uses a non-random or static IV for CBC mode in AES. The underlying issue is IV misuse, enabling potential disclosure of information/confidential communications. Concrete exploit details or in-the-wild status are not provided in the connected documents...