CVE-2024-7099 - CVE House
Back to Database
Status published Critical CVE-2024-7099

SQL Injection in netease-youdao/qanything

Vulnerability Description

netease-youdao/qanything version 1.4.1 contains a vulnerability where unsafe data obtained from user input is concatenated in SQL queries, leading to SQL injection. The affected functions include `get_knowledge_base_name`, `from_status_to_status`, `delete_files`, and `get_file_by_status`. An attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially stealing information from the database. The issue is fixed in version 1.4.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-7099

Credits & Attribution

No credits recorded in the NVD database.

References

More from netease-youdao

View All →
CVE-2024-8027
Stored Cross-Site Scripting (XSS) in netease-youdao/QAnything
Medium 6.1
CVE-2024-8026
CSRF due to overly permissive CORS headers in netease-youdao/qanything
High 8.1
CVE-2024-8024
CORS Misconfiguration in netease-youdao/qanything
High 7.5
CVE-2024-12866
Local File Inclusion in netease-youdao/qanything
High 7.5
CVE-2024-12864
Unauthenticated DoS by Sending Large Filename at File Upload Endpoint in netease-youdao/qanything
High 7.5

Affected Vendor

netease-youdao

View all reports →

Affected Software

netease-youdao/qanything
Vulnerable Versions:
unspecified

Timeline

Official Publish: October 13th, 2024
Last Modified: October 15th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-89

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1213.006 Databases
Collection
T1485 Data Destruction
Impact