Description
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly. NOTE: the project's composer.json file does not indicate an independently published databasement Composer package.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
David-Crty databasement
Default version status: unaffected
1.0.0 to < 1.8.2affected
References
- https://github.com/David-Crty/databasement/security/advisories/GHSA-hm57-pvxc-4pcm ↗
- https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/app/Services/Backup/Databases/MysqlDatabase.php#L22 ↗
- https://github.com/David-Crty/databasement/commit/2d2761905594a2fa2c3d81d48a7c8b6a1784862c ↗
- https://github.com/David-Crty/databasement/commit/22258e3eac594e653f9d04a69d93e83923d61499 ↗
- https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/composer.json#L3 ↗