Attacker Value
Moderate
(1 user assessed)
Exploitability
Low
(1 user assessed)
User Interaction
Required
Privileges Required
None
Attack Vector
Local
0

CVE-2019-7548

Disclosure Date: February 06, 2019
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.

Add Assessment

1
Ratings
  • Attacker Value
    Medium
  • Exploitability
    Low
Technical Analysis

SQLAlchemy is one of the most popular ORMs for Python / SQL Database interaction. It is heavily used in python web applications with frameworks like Flask and Django.

ORMS are heavily used as they prevent the need for raw queries, which also adds input sanitization as part of its process.

This specific exploit would allow SQL Injection if an attacker can control the input sent to group_by as this field was not being filtered. This could resutl in full DB compromise including the compromise of credentials.

Whilst the use of SQLAlchemy is fairly common the specific requirements around the version and the group_by parameter being accessible to an end-user may not be as common.

General Information

Technical Analysis