# CVE-2023-47128: piccolo SQL Injection via named transaction savepoints

> SQL injection in Piccolo ORM allows attackers to read, modify database data, or execute code if savepoint names are user-controlled.

- **Severity:** Critical 9.1 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 10 Nov 2023
- **Updated:** 3 Sep 2024
- **Also known as:** GHSA-xq59-7jf3-rjc6, PYSEC-2023-241

## What is CVE-2023-47128?

CVE-2023-47128 is a critical SQL injection vulnerability in piccolo-orm piccolo, published on 10 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction `savepoints` in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an end developer exposing a `savepoints` `name` parameter to a user is highly unlikely, it would not be unheard of. If a malicious user was able to abuse this functionality they would have essentially direct access to the database and the ability to modify data to the level of permissions associated with the database user. A non exhaustive list of actions possible based on database permissions is: Read all data stored in the database, including usernames and password hashes; insert arbitrary data into the database, including modifying existing records; and gain a shell on the underlying server. Version 1.1.1 fixes this issue.

Weakness: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command)

## Which versions are affected by CVE-2023-47128?

3 open source packages ship an affected version, including piccolo. It affects 1 product.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `piccolo` | PyPI | All versions | 1.1.1 |
| `piccolo` | PyPI | All versions | 1.1.1 |
| `piccolo` | PyPI | All versions | 1.1.1 |

Products: Piccolo-Orm Piccolo.

## How do I fix CVE-2023-47128?

Upgrade piccolo to 1.1.1 or later.

## Is CVE-2023-47128 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-47128 exists.

## Other vulnerabilities in piccolo-orm piccolo

- [CVE-2023-41885](https://insights.sbomify.com/CVE-2023-41885/): Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration (medium 5.3)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2023-47128 and fix it if it is affected.

What it is: CVE-2023-47128 is a critical SQL injection vulnerability in piccolo-orm piccolo, published on 10 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-47128 exists.

Affected packages and fixed versions:
- piccolo (PyPI): affected all versions; fixed in 1.1.1
- piccolo (PyPI): affected all versions; fixed in 1.1.1
- piccolo (PyPI): affected all versions; fixed in 1.1.1

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2023-47128/ (Markdown: https://insights.sbomify.com/CVE-2023-47128/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2023-47128
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-47128
- OSV: https://osv.dev/vulnerability/CVE-2023-47128

---
From sbomify Insights: https://insights.sbomify.com/CVE-2023-47128/
Summaries are generated and may contain mistakes; the official description above is the record.