pyLoad SQL Injection Vulnerability in the add_links Parameter of the /json/add_package API

A SQL injection vulnerability has been identified in pyLoad, a download manager written in Python, prior to version 0.5.0b3.dev91. The issue arises in the /json/add_package API, specifically within the add_links parameter. This vulnerability allows attackers to manipulate the SQL query by injecting malicious payloads, potentially leading to unauthorized data modification or deletion in the application's database. The vulnerability has been patched in version 0.5.0b3.dev91.

Impact

Exploitation of this vulnerability allows attackers to modify or delete database records, resulting in data corruption or loss.

Reproduction

To reproduce this vulnerability, send a POST request to the /json/add_package endpoint with a crafted add_links parameter that includes SQL injection payloads. The injected SQL code will be executed by the application, allowing for manipulation of the database. This can be done using tools like Burp Suite or by writing a custom script that automates the injection process.

Remediation

Users can update to pyLoad version 0.5.0b3.dev91 or later to address this vulnerability.