{"answers":{"affected":"2 open source packages ship an affected version, including sqlpage. It affects 1 product.","exploited":"There is no known exploitation of CVE-2023-42454 in the wild and no public exploit code.","fix":"Upgrade sqlpage to 0.11.1 or later.","what":"CVE-2023-42454 is a critical vulnerability in lovasoa SQLpage, published on 18 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-42454 and fix it if it is affected.\n\nWhat it is: CVE-2023-42454 is a critical vulnerability in lovasoa SQLpage, published on 18 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2023-42454 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- sqlpage (crates.io): affected all versions; fixed in 0.11.1\n- sqlpage (crates.io): affected all versions; fixed in 0.11.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-42454/ (Markdown: https://insights.sbomify.com/CVE-2023-42454/index.md)","id":"CVE-2023-42454","markdown":"https://insights.sbomify.com/CVE-2023-42454/index.md","name":"CVE-2023-42454","record":{"aliases":["GHSA-v5wf-jg37-r9m5"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_read","security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"SQL webapp builder","requires_auth":"none","summary":"Attackers can retrieve database credentials from exposed configuration files in SQLPage, enabling direct database access and data theft.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"sqlpage","vendor":"lovasoa"}],"cvss":{"score":10,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"description":"SQLpage is a SQL-only webapp builder. Someone using SQLpage versions prior to 0.11.1, whose SQLpage instance is exposed publicly, with a database connection string specified in the `sqlpage/sqlpage.json` configuration file (not in an environment variable), with the web_root is the current working directory (the default), and with their database exposed publicly, is vulnerable to an attacker retrieving database connection information from SQLPage and using it to connect to their database directly. Version 0.11.0 fixes this issue. Some workarounds are available. Using an environment variable instead of the configuration file to specify the database connection string prevents exposing it on vulnerable versions. Using a different web root (that is not a parent of the SQLPage configuration directory) fixes the issue. One should also avoid exposing one's database publicly.","ecosystems":["crates.io"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"SQLpage vulnerable to public exposure of database credentials","id":"CVE-2023-42454","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"information_disclosure","year":"2023"},"n_packages":2,"n_references":3,"next":{"headline":"Wazuh vulnerable to user privilege escalation","id":"CVE-2023-42455"},"packages":[{"ecosystem":"crates.io","fixed":["0.11.1"],"introduced":["0"],"last_affected":[],"package":"sqlpage","purl":null,"source":"GHSA-v5wf-jg37-r9m5"},{"ecosystem":"crates.io","fixed":["0.11.1"],"introduced":["0"],"last_affected":[],"package":"sqlpage","purl":"pkg:cargo/sqlpage","source":"GHSA-v5wf-jg37-r9m5"}],"prev":{"headline":"Improper validation of receipts allows forged read receipts in matrix synapse","id":"CVE-2023-42453"},"products":["SQLpage"],"published":"2023-09-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2024-09-26","vendors":["lovasoa"]},"summary":"Attackers can retrieve database credentials from exposed configuration files in SQLPage, enabling direct database access and data theft.","url":"https://insights.sbomify.com/CVE-2023-42454/"}