Description

zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The `azuracast:restore` command executes the `db.sql` file extracted from a backup archive without any content validation or sanitization. This allows a remote attacker to escalate privileges

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-17T21:16:47.290Z",
  "pubdate": "2026-08-17T21:16:47.290Z",
  "executiveSummary": "AzuraCast versions up to and including 0.23.7 contain a critical SQL injection vulnerability residing within the backup restore functionality. The flaw is triggered when the application processes backup archives during restoration operations. Specifically, the azuracast:restore command programmatically executes the raw contents of the db.sql file extracted from the provided backup archive without performing any requisite content validation, sanitization, or parameterization. This architectural oversight exposes the underlying database management system to arbitrary SQL execution via maliciously crafted backup files. Successful exploitation of this vulnerability allows a remote attacker to compromise the integrity and confidentiality of the underlying database. The primary risk implication involves privilege escalation, where an attacker can manipulate database records to elevate their authorization level within the application, potentially achieving full administrative control over the affected AzuraCast instance. Exploitation generally requires the capability to supply or upload a malicious backup archive to the targeted system, contingent upon the specific interaction vectors exposed by the backup restoration mechanism in the given deployment.",
  "technicalDetails": "The vulnerability is rooted in insecure data handling within the backup restoration subsystem of AzuraCast. The affected component is the azuracast:restore command, which is responsible for ingesting and applying database dumps during system recovery or migration procedures. The specific root cause is the direct execution of the unverified db.sql file extracted from the backup archive directly into the database engine, bypassing any input sanitization routines or secure query abstraction layers.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious backup archive containing a structurally modified db.sql file. This file embeds arbitrary SQL statements designed to interact with the database schema—such as updating user role tables or inserting administrative accounts. Second, the attacker induces the application to process this malicious backup file through the azuracast:restore command or associated administrative upload interfaces. Third, the restoration routine extracts the archive, isolates the db.sql payload, and passes its contents directly to the database execution handler without performing checks for malicious SQL injection constructs.\nAs the raw SQL statements are executed against the database, the injected commands alter database tables directly. In the context of privilege escalation, the payload typically targets authorization tables to modify user privilege levels, granting administrative access to an attacker-controlled account. The vulnerable versions include all AzuraCast releases up to and including version 0.23.7. The vulnerability represents a severe vector for post-exploitation impact, enabling complete database takeover, data exfiltration, or persistence establishment depending on the executed SQL syntax."
}