Description

Unauthenticated SQL Injection in Boost <= 2.0.4 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-24T22:16:51.650Z",
  "pubdate": "2026-08-24T22:16:51.650Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability has been identified in Boost versions <= 2.0.4. This security flaw allows remote, unauthenticated attackers to execute arbitrary SQL commands against the underlying database by manipulating vulnerable input parameters within the application. The vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected system, potentially leading to unauthorized data access, database modification, or complete system compromise. Successful exploitation requires network access to the target application and does not necessitate prior authentication or privileged access levels. Given the severity of remote SQL injection flaws, immediate remediation is strongly advised to prevent malicious exploitation by threat actors targeting the application layer.",
  "technicalDetails": "The vulnerability stems from improper neutralization of special elements used in SQL commands within Boost <= 2.0.4. Specifically, user-supplied input parameters processed by the application are insufficiently sanitized, validated, or parameterized before being concatenated directly into dynamic SQL queries. This allows malicious actors to inject arbitrary SQL syntax via HTTP requests.\nThe attack flow begins when an unauthenticated attacker crafts a specialized HTTP request containing malicious SQL payload sequences directed at vulnerable input endpoints. Upon receipt, the application processes the tainted input and incorporates it directly into the database query structure without adequate abstraction or use of parameterized queries. The database query interpreter then executes the attacker-controlled SQL commands alongside or instead of the intended application logic.\nNetwork exposure is present externally via the web application interface, requiring no authentication credentials or specialized privileges to initiate the attack vector. Payload behavior may vary depending on the attacker's objectives, ranging from error-based and boolean-based data extraction to union-based retrieval of sensitive database contents, including user credentials, configuration data, and application secrets. In advanced scenarios, depending on database configuration and backend privileges, successful exploitation could facilitate operating system command execution or unauthorized data modification, leading to full compromise of the database tier."
}