Parameter Injection Vulnerability in WhoDB Database Management Tool

CVE-2025-24787

What is CVE-2025-24787?

WhoDB, an open-source database management tool, has a vulnerability that allows parameter injection in database connection strings. This flaw occurs because the application combines user input into URI strings without proper sanitization. Consequently, an attacker can append potentially dangerous parameters, such as &allowAllFiles=true, enabling unauthorized access to local files. This issue is particularly critical when connected to a MySQL server, allowing attackers to execute commands that read files from the host machine. Users must update to version 0.45.0 or later to mitigate these risks.

References