CVE-2019-7548

SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.

Recent assessments:

kevthehermit at April 23, 2020 8:30pm UTC reported:

SQLAlchemy is one of the most popular ORMs for Python / SQL Database interaction. It is heavily used in python web applications with frameworks like Flask and Django.

ORMS are heavily used as they prevent the need for raw queries, which also adds input sanitization as part of its process.

This specific exploit would allow SQL Injection if an attacker can control the input sent to group_by as this field was not being filtered. This could resutl in full DB compromise including the compromise of credentials.

Whilst the use of SQLAlchemy is fairly common the specific requirements around the version and the group_by parameter being accessible to an end-user may not be as common.

Assessed Attacker Value: 3
Assessed Attacker Value: 3Assessed Attacker Value: 2