{"answers":{"affected":"3 open source packages ship an affected version, including piccolo. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-47128 exists.","fix":"Upgrade piccolo to 1.1.1 or later.","what":"CVE-2023-47128 is a critical SQL injection vulnerability in piccolo-orm piccolo, published on 10 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2023-47128 and fix it if it is affected.\n\nWhat it is: CVE-2023-47128 is a critical SQL injection vulnerability in piccolo-orm piccolo, published on 10 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-47128 exists.\n\nAffected packages and fixed versions:\n- piccolo (PyPI): affected all versions; fixed in 1.1.1\n- piccolo (PyPI): affected all versions; fixed in 1.1.1\n- piccolo (PyPI): affected all versions; fixed in 1.1.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-47128/ (Markdown: https://insights.sbomify.com/CVE-2023-47128/index.md)","id":"CVE-2023-47128","markdown":"https://insights.sbomify.com/CVE-2023-47128/index.md","name":"CVE-2023-47128","record":{"aliases":["GHSA-xq59-7jf3-rjc6","PYSEC-2023-241"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["data_read","data_modify","code_execution"],"network_reachable":"yes","non_default_config":false,"product_category":"Python ORM library","requires_auth":"none","summary":"SQL injection in Piccolo ORM allows attackers to read, modify database data, or execute code if savepoint names are user-controlled.","user_interaction":"not_required","vuln_class":"sql_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"piccolo","vendor":"piccolo-orm"}],"cvss":{"score":9.1,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"description":"Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction `savepoints` in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an end developer exposing a `savepoints` `name` parameter to a user is highly unlikely, it would not be unheard of. If a malicious user was able to abuse this functionality they would have essentially direct access to the database and the ability to modify data to the level of permissions associated with the database user. A non exhaustive list of actions possible based on database permissions is: Read all data stored in the database, including usernames and password hashes; insert arbitrary data into the database, including modifying existing records; and gain a shell on the underlying server. Version 1.1.1 fixes this issue.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"piccolo SQL Injection via named transaction savepoints","id":"CVE-2023-47128","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"sql_injection","year":"2023"},"n_packages":3,"n_references":2,"next":{"headline":"Statamic CMS remote code execution via front-end form uploads","id":"CVE-2023-47129"},"packages":[{"ecosystem":"PyPI","fixed":["1.1.1"],"introduced":["0"],"last_affected":[],"package":"piccolo","purl":null,"source":"GHSA-xq59-7jf3-rjc6"},{"ecosystem":"PyPI","fixed":["1.1.1"],"introduced":["0"],"last_affected":[],"package":"piccolo","purl":"pkg:pypi/piccolo","source":"GHSA-xq59-7jf3-rjc6"},{"ecosystem":"PyPI","fixed":["1.1.1"],"introduced":["0"],"last_affected":[],"package":"piccolo","purl":"pkg:pypi/piccolo","source":"PYSEC-2023-241"}],"prev":{"headline":"Weak Authentication in Session Handling in typo3/cms-core","id":"CVE-2023-47127"},"products":["piccolo"],"published":"2023-11-10","related":[{"cvss_score":5.3,"headline":"Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration","id":"CVE-2023-41885","kev_date_added":null,"published":"2023-09-12"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2024-09-03","vendors":["piccolo-orm"]},"summary":"SQL injection in Piccolo ORM allows attackers to read, modify database data, or execute code if savepoint names are user-controlled.","url":"https://insights.sbomify.com/CVE-2023-47128/"}