Description (CNA)
Hasura GraphQL 1.3.3 contains a local file read vulnerability that allows attackers to access system files through SQL injection in the query endpoint. Attackers can exploit the pg_read_file() PostgreSQL function by crafting malicious SQL queries to read arbitrary files on the server.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Hasura / Hasura GraphQL | affected 1.3.3 |
CWE
CWE-89
References
- https://www.exploit-db.com/exploits/49790
- https://github.com/hasura/graphql-engine
- https://www.vulncheck.com/advisories/hasura-graphql-local-file-read-via-sql-injection
ADP enrichment
No English description supplied.
No references supplied.