piccolo SQL Injection via named transaction savepoints

CVE-2023-47128

What is CVE-2023-47128?

Piccolo, an object-relational mapping and query builder that supports asyncio, has a vulnerability concerning the handling of named transaction savepoints. This issue could allow attackers to exploit SQL Injection vulnerabilities via f-strings in all database implementations prior to version 1.1.1. Although the likelihood of developers exposing savepoint parameters to users is low, if an attacker successfully exploits this vulnerability, they could potentially gain unauthorized access to the database. This includes the ability to read sensitive data, insert arbitrary information, and modify existing records. Furthermore, such exploitation could lead to gaining shell access on the underlying server, posing significant risks to data integrity and security.

References