CVE-2025-24787: 
Homebrew 脆弱性の分析と軽減

WhoDB, an open source database management tool, was found to contain a critical security vulnerability (CVE-2025-24787) related to parameter injection in database connection strings. The vulnerability was discovered and disclosed on February 6, 2025, affecting all versions up to and including 0.45.0. This security flaw allows attackers to read local files on the machine where the application is running (GitHub Advisory).

The vulnerability stems from unsafe string concatenation when building database connection URIs, which are passed to libraries responsible for setting up database connections. The application fails to properly escape or encode user input, allowing injection of arbitrary parameters into the URI string. The vulnerability has received a CVSS v3.1 base score of 8.6 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, indicating network accessibility, low attack complexity, and no required privileges or user interaction (NVD, Security Online).

The vulnerability enables attackers to read local files on the host machine running WhoDB. By injecting the parameter '&allowAllFiles=true' into the connection URI and connecting to any MySQL server (including an attacker-controlled one), the attacker can execute the 'LOAD DATA LOCAL INFILE' query to access any file on the host machine. The attack requires no user authentication to WhoDB, only authentication to any database server (GitHub Advisory).

The vulnerability has been addressed in version 0.45.0 of WhoDB. All users are strongly advised to upgrade to this version or later. There are no known workarounds for this vulnerability (GitHub Advisory).