Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2022-3801
CVE-2022-3801:
vulnerability analysis and mitigation
Overview
A critical SQL injection vulnerability (CVE-2022-3801) was discovered in IBAX go-ibax, specifically affecting the /api/v2/open/rowsInfo endpoint. The vulnerability was identified and reported on October 24, 2022, impacting versions with commits dating back to July 18, 2020 (GitHub Issue).
Technical details
The vulnerability exists in the /packages/api/database.go file where the order parameter is not properly sanitized in SQL query construction. The affected code uses fmt.Sprintf for query building, allowing direct injection of malicious SQL commands through the order parameter. This vulnerability is particularly concerning as it affects both scenarios: when the 'where' clause is empty and when it contains conditions (GitHub Issue).
Impact
The vulnerability allows attackers to spoof identity, tamper with existing data, achieve complete disclosure of all system data, potentially destroy data or make it inaccessible, and potentially gain administrator privileges on the database server (GitHub Issue).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management