CVE-2023-30555

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attacker to query the connected databases.Affected versions are subject to SQL injection in the `explain` method in `sql_optimize.py`. User input coming from the `db_name` parameter value in the `explain` endpoint is passed to the following `query` methods of each database engine for execution. `query` in `sql/engines/mssql.py`, and `query` in `sql/engines/oracle.py`. Each of these issues may be mitigated by escaping user input or by using prepared statements when executing SQL queries. This issue is also indexed as `GHSL-2022-108`.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Apr 19, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-305566.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attackeCVE-2023-305576.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attackeCVE-2023-305586.5Archery is an open source SQL audit platform. The Archery project contains multiple SQL injection vulnerabilities, that may allow an attackeCVE-2023-305595.7The firmware update package for the wireless card is not properly signed and can be modified.CVE-2023-30569.8A vulnerability was found in YFCMF up to 3.0.4. It has been declared as problematic. This vulnerability affects unknown code of the file indCVE-2023-305606.8The configuration from the PCU can be modified without authentication using physical connection to the PCU.CVE-2023-305616.1The data flowing between the PCU and its modules is insecure. A threat actor with physical access could potentially read or modify data by aCVE-2023-305626.7A GRE dataset file within Systems Manager can be tampered with and distributed to PCUs.CVE-2023-305638.2A malicious file could be uploaded into a System Manager User Import Function resulting in a hijacked session.CVE-2023-305646.9Alaris Systems Manager does not perform input validation during the Device Import Function.CVE-2023-305653.5An insecure connection between Systems Manager and CQI Reporter application could expose infusion data to an attacker.CVE-2023-30579.8A vulnerability was found in YFCMF up to 3.0.4. It has been rated as problematic. This issue affects some unknown processing of the file app