CVE-2023-50718: 
JavaScript vulnerability analysis and mitigation

NocoDB, a software for building databases as spreadsheets, was found to contain a SQL injection vulnerability (CVE-2023-50718) prior to version 0.202.10. The vulnerability was discovered and disclosed on May 14, 2024, affecting the table name handling functionality in the software (GitHub Advisory).

The vulnerability exists in VitessClient.ts where the table_name parameter is not properly escaped in SQL queries. Specifically, in the columnList function, the variable ${args.tn} representing the table name is directly interpolated into the SQL query without proper sanitization. The vulnerability has been assigned a CVSS v3.1 score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N, indicating network attack vector, low attack complexity, high privileges required, and potential for high impact on confidentiality and integrity (GitHub Advisory).

The vulnerability could allow an authenticated attacker with create access to perform SQL injection attacks on MySQL databases. This could potentially result in unauthorized access to and leakage of sensitive data stored in the database (GitHub Advisory).

The vulnerability requires an authenticated user with create access to exploit. The attack can be executed by including special characters (such as single quotes) in the table name to escape the existing query and inject arbitrary SQL commands (GitHub Advisory).

The vulnerability has been patched in NocoDB version 0.202.10. Users are advised to upgrade to this version or later to address the security issue (GitHub Advisory).