SQL injection via SQL-run endpoint in db-gpt (CVE-2024-10835)
Date: 2024
Affected: eosphoros-ai/db-gpt 0.6.0
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: Critical

db-gpt v0.6.0 web API POST /api/v1/editor/sql/run allows execution of arbitrary SQL without access control, enabling SQL injection / data exfiltration.


Mitigations:

Architectural layers (MAESTRO):