-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the MySQLSelectTool class, which is intended for read-only SQL queries but could be exploited to write files. The root cause was an incomplete denylist of SQL keywords. The security advisory and the associated commits, specifically ea49f8c4f35bffb56021a2ea2c9b07817fcc31b6, clearly show the patch that fixed the issue. The patch adds INTO, OUTFILE, DUMPFILE, and LOAD_FILE to the $forbiddenStatements array within the MySQLSelectTool.php file. This array is used by the validateReadOnly method to check if a query is safe to run. The main entry point for the tool is the __invoke method, which takes the user's query and calls validateReadOnly before execution. Because the validation was flawed, both __invoke (as the entry point that trusts the validation) and validateReadOnly (as the function with the flawed logic) are identified as the vulnerable functions. An attacker could craft a SELECT query containing INTO OUTFILE to write a file on the database server, and the vulnerable version of the code would fail to block it.
Neuron\Tools\Toolkits\MySQL\MySQLSelectTool::__invokesrc/Tools/Toolkits/MySQL/MySQLSelectTool.php
Neuron\Tools\Toolkits\MySQL\MySQLSelectTool::validateReadOnlysrc/Tools/Toolkits/MySQL/MySQLSelectTool.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| neuron-core/neuron-ai | composer | <= 2.8.11 | 2.8.12 |