Description

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server process, cause SQLite to create a database file there, and place attacker-controlled table content in that file. This permits arbitrary file creation or overwrite, causing filesystem integrity loss and denial of service; remote code execution is possible only when another service interprets the written file or the process has a suitably privileged writable target. This issue is fixed in version 0.4.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-14T20:16:44.637Z",
  "pubdate": "2026-09-14T20:16:44.637Z",
  "executiveSummary": "A critical security vulnerability exists in Anyquery versions prior to 0.4.5, involving the insecure handling of the ATTACH DATABASE command within the MySQL-compatible server interface.\nThe vulnerability is classified as an improper access control issue, where the server fails to sanitize or restrict filesystem targets provided by unauthenticated remote users.\nThis flaw allows an attacker to interact directly with the underlying SQLite engine, facilitating arbitrary file creation or file overwrite operations on the host filesystem.\nThe primary impact involves the loss of filesystem integrity and potential denial of service (DoS) conditions.\nWhile remote code execution (RCE) is not directly facilitated by the application itself, it may be achieved in environments where the overwritten file is subsequently parsed or executed by another service, or if the attacker gains control over a sensitive system path.\nThe attack requires network connectivity to the MySQL-compatible server port; no authentication is required to trigger the vulnerable functionality.\nRisk mitigation requires upgrading the Anyquery software to version 0.4.5 or later.",
  "technicalDetails": "The vulnerability resides within the Anyquery server component, specifically in how it proxies MySQL-compatible protocol requests to the internal SQLite database engine.\nThe root cause is the lack of input validation and sanitization regarding the ATTACH DATABASE SQL command, which SQLite utilizes to mount auxiliary database files to the current connection.\nIn the affected versions (prior to 0.4.5), the server fails to intercept or whitelist path arguments passed to ATTACH DATABASE. Consequently, the Anyquery process executes these commands with the same filesystem permissions as the user running the server process.\nThe exploitation flow proceeds as follows: First, the attacker establishes a network connection to the MySQL-compatible port exposed by the Anyquery server. Second, the attacker issues a malicious SQL payload containing an ATTACH DATABASE statement. By specifying an arbitrary file path accessible to the server process, the attacker compels SQLite to create or overwrite the target file on the host filesystem.\nThird, the attacker uses standard SQL DDL (Data Definition Language) commands, such as CREATE TABLE and INSERT, to populate the newly created or overwritten database file with arbitrary content. Because SQLite writes to the specified file path, the attacker can precisely control the file's contents.\nThe post-exploitation impact is multifaceted. At a minimum, the ability to overwrite system files leads to a denial-of-service, as configuration files or binaries may be corrupted or replaced with non-functional SQLite database fragments. Furthermore, if the attacker chooses a path corresponding to an executable script, a web root, or a library file utilized by another service on the host, the attacker may achieve remote code execution through secondary exploitation vectors.\nThis vulnerability highlights a failure in trust boundaries between the network-facing MySQL interface and the filesystem-interfacing SQLite engine. By failing to restrict the database engine's file access capabilities, the application inadvertently grants unauthenticated remote users the ability to perform arbitrary file operations, provided those operations remain syntactically compatible with SQLite's internal storage format."
}