CVE-2024-10835
CVSS v3
9.8
CRITICAL
EPSS Score
1.1 %
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/sql/run` allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write using DuckDB SQL, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE).
Technical details
- Published
- 2025-03-20
Frequently asked questions
What is CVE-2024-10835?
In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/sql/run` allows execution of arbitrary SQL queries without any access control. This vulnerability can be exploited by attackers to perform Arbitrary File Write using DuckDB SQL, enabling them to write arbitrary files to the victim's file system. This can potentially lead to Remote Code Execution (RCE).
Is CVE-2024-10835 actively exploited?
Active exploitation of CVE-2024-10835 has not been confirmed. The EPSS score is 1.1%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2024-10835?
CVE-2024-10835 has a CVSS v3 base score of 9.8 (CRITICAL severity).
Is CVE-2024-10835 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2024 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).