Description

A security vulnerability has been detected in Tencent WeKnora up to 0.8.1. Impacted is the function validateSubquery of the file internal/utils/inject.go of the component SQL Validator. The manipulation leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.8.2 is recommended to address this issue. The identifier of the patch is d7ccd5ba517cc3968e6d5000a2ab0f4b51ef1dda. It is recommended to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-10-12T10:16:43.983Z",
  "pubdate": "2026-10-12T10:16:43.983Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in Tencent WeKnora versions up to 0.8.1, residing within the SQL Validator component.\nThe vulnerability is triggered via improper input handling in the validateSubquery function located in internal/utils/inject.go.\nThis flaw allows remote, unauthenticated attackers to manipulate SQL queries, potentially leading to unauthorized data access, modification, or complete database compromise.\nThe vulnerability is currently publicly disclosed, significantly increasing the risk of active exploitation.\nOrganizations utilizing affected versions face substantial risk to data confidentiality and integrity.\nImmediate patching to version 0.8.2 is required to remediate this security exposure.",
  "technicalDetails": "The vulnerability is located within the SQL Validator component of Tencent WeKnora, specifically in the internal/utils/inject.go file. The root cause of the SQL injection lies in the validateSubquery function, which fails to adequately sanitize or parameterize user-supplied input before incorporating it into dynamic SQL query constructions.\nThe attack flow initiates when a remote, unauthenticated attacker submits a crafted subquery payload to an endpoint that utilizes the vulnerable validateSubquery function. Because the validator performs insufficient validation on the subquery structure, the input is concatenated or directly embedded into the backend SQL execution context.\nBy manipulating the subquery syntax, an attacker can break out of the intended query structure, enabling the execution of arbitrary SQL commands. This effectively permits the attacker to bypass authentication mechanisms, perform unauthorized read or write operations, exfiltrate sensitive data from the database, or potentially escalate privileges depending on the database user's permissions.\nThe vulnerability is exacerbated by the fact that the exploit path is reachable remotely without requiring prior authentication or specific elevated system privileges. The flaw resides in the core logic of the SQL validation layer, meaning any data flow directed through this specific function is inherently susceptible if the input contains malicious SQL sequences.\nPost-exploitation impact includes full database compromise, which in many application architectures serves as a primary vector for horizontal or vertical movement within the underlying infrastructure. The disclosure of the exploit increases the risk of automated or targeted attacks, as the technical barrier for successfully crafting a payload is lowered for malicious actors.\nThe fix provided in patch d7ccd5ba517cc3968e6d5000a2ab0f4b51ef1dda modifies the validation logic within validateSubquery to ensure that subquery inputs are treated strictly as non-executable data or validated against a hardened schema, preventing the interpretation of injected SQL syntax."
}