6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-44905

CVE-2024-44905: go-pg SQL injection vulnerability via the component /types/append_value.go

go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/append_value.go.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-44905

CVE-2024-44905:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions
github.com/go-pg/pg/v10	go	<= 10.13.0
github.com/go-pg/pg/v9	go	<= 9.2.1
github.com/go-pg/pg	go	<= 8.0.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2024-44905, is a SQL injection in the go-pg library, specifically within the types/append_value.go component. The advisory explicitly points to the types.appendValue function (specifically line 151 in commit 30e7053c6cacdd44d06cf2b92183b49188b7c922) as being part of the vulnerable pathway. This function acts as a dispatcher, selecting an appropriate appender function based on the data type of the value being processed for an SQL query.

The SQL injection occurs when appendValue routes data, particularly strings or byte slices, to specialized appender functions within the same file, such as types.appendStringValue or types.appendBytesValue. These functions, in turn, call lower-level routines (like AppendString and AppendBytes, respectively, which are not defined in the provided file content but are part of the types package) to append the data to the query buffer. The vulnerability arises because these lower-level routines, or the logic within appendStringValue/appendBytesValue if they performed direct manipulation, are presumed to not adequately sanitize the input. This lack of sanitization allows specially crafted input to alter the intended SQL query structure, leading to SQL injection.

Since no specific patch details are available, this analysis relies on the information from the advisory, the structure of the append_value.go file, and common SQL injection patterns. The identified functions (types.appendValue, types.appendStringValue, types.appendBytesValue) are all within the specified vulnerable component and would likely appear in a runtime profile or stack trace during the exploitation of this vulnerability when malicious string or byte array data is processed.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.