4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-7333

CVE-2023-7333: bluelabsio records-mover Table Object sql injection

A weakness has been identified in bluelabsio records-mover up to 1.5.4. The affected element is an unknown function of the component Table Object Handler. This manipulation causes sql injection. The attack needs to be launched locally. Upgrading to version 1.6.0 is sufficient to fix this issue. Patch name: 3f8383aa89f45d861ca081e3e9fd2cc9d0b5dfaa. You should upgrade the affected component.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2023-7333

CVE-2023-7333:

4.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
records-mover	pip	< 1.6.0	1.6.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic SQL injection caused by constructing raw SQL queries using Python's f-strings, where table and schema names are directly embedded into the query string. The affected component is described as the 'Table Object Handler', and the analysis of the patch confirms this, as multiple functions across different modules that handle database table operations were vulnerable.

The root cause is the reliance on string formatting (f"...{variable}...") to create SQL statements. Even though a quoting function (quote_schema_and_table) was used, this approach is inherently unsafe and was clearly insufficient to prevent injection. An attacker could likely bypass the quoting by providing specially crafted schema or table names.

The patch systematically replaces this unsafe pattern with the use of SQLAlchemy's SQL Expression Language. Instead of building strings, the code now creates Table objects and uses constructs like select(), table.delete(), and DropTable(). SQLAlchemy then safely generates the final SQL query, correctly quoting and escaping identifiers to prevent SQL injection. The widespread nature of this change across the codebase indicates a systemic issue rather than an isolated mistake.

Any runtime profile during exploitation would show one of the identified vulnerable functions (VerticaDBDriver.has_table, TablePrep.prep_table_for_load, TableRecordsSource.to_dataframes_source, SpectrumRecordsTarget.prep_bucket) executing a malformed SQL query constructed from user-provided input.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.