SQL Injection Vulnerability in SQLBot by DataEase
CVE-2026-32950
What is CVE-2026-32950?
SQLBot, an intelligent data query system developed by DataEase, has a significant SQL Injection vulnerability present in versions before 1.7.0. This flaw allows authenticated users to execute remote commands on the backend server without necessary privileges. The vulnerability stems from unsanitized concatenation of Excel Sheet names into PostgreSQL table names and flawed embedding of these names into SQL statements. Attackers can exploit this by uploading crafted files to bypass limitations and insert malicious commands into the SQL execution context, leading to potential database takeover and exposure of sensitive files. It is crucial for users to update to version 1.7.0 or later to mitigate this risk.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
SQLBot < 1.7.0