sqlparse PHP Code Injection via Unescaped Dollar Signs

Executive Summary

This vulnerability is a PHP code injection flaw in the sqlparse library up to version 0.6.0. Attackers can inject PHP expressions by supplying SQL text with unescaped dollar signs, such as ${expr} or {${expr}}. These sequences are placed in double-quoted strings and executed as PHP code when the generated snippet runs.

Useful 0 Not Useful 0

Detection Guidance

Check for sqlparse versions prior to 0.6.0 using package managers like pip show sqlparse or dpkg -l | grep sqlparse. Inspect code or logs for unescaped dollar signs in SQL inputs, especially ${expr} or {${expr}} patterns.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary PHP code on your system, potentially leading to unauthorized access, data theft, or system compromise. The impact depends on the privileges of the user running the affected application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is exposed due to the flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade sqlparse to version 0.6.0 or later immediately. Review and sanitize all SQL inputs to escape dollar signs. Audit applications using sqlparse for PHP code injection risks.

Useful 0 Not Useful 0