MobSF has SQL Injection in its SQLite Database Viewer Utils
Date: 2026-03
Affected: pip/mobsf
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-33545
CWE: CWE-89
CVSS: 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H)

## Description MobSF's `read_sqlite()` function in `mobsf/MobSF/utils.py` (lines 542-566) uses Python string formatting (`%`) to construct SQL queries with table names read from a SQLite database's `sqlite_master` table. When a security analyst uses MobSF to analyze a malicious mobile application containing a crafted SQLite database, attacker-controlled table names are interpolated directly into SQL queries without parameterization or escaping. This allows an attacker to: 1. **Cause Denial of Service** -- A malicious table name causes the database viewer to crash, preventing the analyst from viewing ANY data in the SQLite database. A malicious app can use this to hide sensitive data (C2 server URLs, stolen credentials, API keys) from MobSF's analysis. 2. **Achieve SQL Injection** -- The `SELECT * FROM` query on line 557 is provably injectable via `UNION SELECT`, allowing attacker-controlled data to be returned in query results. The current code structure (a `PRAGMA` statement that runs first on line 553) limits the full exploitation chain, but the underlying code is verifiably injectable. ## Root Cause The vulnerable code in `mobsf/MobSF/utils.py:542-566`: ```python def read_sqlite(sqlite_file): """Sqlite Dump - Readable Text.""" table_dict = {} try: con = sqlite3.connect(sqlite_file) cur = con.cursor() cur.execute('SELECT name FROM sqlite_master WHERE type=\'table\';') tables = cur.fetchall() for table in tables:


Mitigations:

Architectural layers (MAESTRO):