SQL Injection Vulnerability in qanything version 1.4.1

CVE-2024-7099

What is CVE-2024-7099?

The vulnerability in qanything version 1.4.1 allows for SQL injection through the improper handling of user input. Specifically, unsafe data input is concatenated into SQL queries used in several functions, including 'get_knowledge_base_name', 'from_status_to_status', 'delete_files', and 'get_file_by_status'. An attacker could exploit this flaw to execute arbitrary SQL commands, potentially gaining unauthorized access to sensitive information stored in the underlying database. Version 1.4.2 addresses this vulnerability, emphasizing the importance of upgrading to the latest release to mitigate potential security risks.

References