Home » Database

AVID-2026-R0014

Description

Arbitrary File Write via SQL Injection in eosphoros-ai/db-gpt (CVE-2024-10835)

Details

In eosphoros-ai/db-gpt version v0.6.0, the web API POST /api/v1/editor/sql/run allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write using DuckDB SQL, enabling them to write arbitrary files to the victim’s file system. This can potentially lead to Remote Code Execution (RCE).

References

Affected or Relevant Artifacts

  • Developer: eosphoros-ai
  • Deployer: eosphoros-ai
  • Artifact Details:
TypeName
Systemeosphoros-ai/db-gpt

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.0
Vector StringCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Base Score9.1
Base Severity🔴 Critical
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-89CWE-89 Improper Neutralization of Special Elements used in an SQL Command

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2025-03-20
  • Version: 0.3.1
  • AVID Entry