SQL Injection Vulnerability in qanything version 1.4.1

CVE-2024-7099

What is CVE-2024-7099?

The vulnerability in qanything version 1.4.1 allows for SQL injection through the improper handling of user input. Specifically, unsafe data input is concatenated into SQL queries used in several functions, including 'get_knowledge_base_name', 'from_status_to_status', 'delete_files', and 'get_file_by_status'. An attacker could exploit this flaw to execute arbitrary SQL commands, potentially gaining unauthorized access to sensitive information stored in the underlying database. Version 1.4.2 addresses this vulnerability, emphasizing the importance of upgrading to the latest release to mitigate potential security risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References