Description (CNA)
SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. Attackers can execute arbitrary SQL on the read-write asset-content database via unescaped method parameters and REGEXP clauses to read, modify, or delete cross-notebook data.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| siyuan-note / siyuan | affected 0 before 3.7.3; unaffected 3.7.3 |
CWE
CWE-89
References
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-fph3-ghq9-vw66
- https://www.vulncheck.com/advisories/siyuan-before-sql-injection-via-fulltextsearchassetcontent
ADP enrichment
No English description supplied.