Long2ice Asyncmy SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Long2ice Asyncmy versions through 0.2.10. This vulnerability allows attackers to execute arbitrary SQL commands by manipulating dictionary keys. The issue arises because only the values of the dictionaries are properly escaped, leaving room for injection through crafted keys.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can execute arbitrary SQL commands. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

The vulnerability can be reproduced by sending a dictionary with crafted keys to a function that processes dictionary inputs without proper key escaping. This will allow the injection of SQL commands through the keys, which can then be executed by the database.

Remediation

Users are advised to update to the latest version of Long2ice Asyncmy, which addresses this vulnerability by ensuring that both dictionary keys and values are properly escaped before being processed.