Chat2db CVE-2026-4173

This vulnerability presents a moderate-to-significant real-world risk despite a CVSS 6.3 (Medium) rating. Key risk signals: (1) Attack Vector: Network/Low Complexity—easily exploitable once authenticated; (2) Exploitation Evidence: Public POC available on GitHub (AnalogyC0de/public_exp), indicating active disclosure and likely weaponization; (3) Authentication Required: PR:L (Low Privilege) mitigates attack surface to authenticated users only, reducing exposure in air-gapped environments but problematic for SaaS deployments; (4) Vendor Non-Response: Lack of vendor engagement indicates no patch timeline or mitigation guidance; (5) EPSS/Automation: The 'E:P' vector indicates proof-of-concept exists; automatable nature of SQL injection makes this high-velocity attack material. SSVC assessment: Exploitation status=proof-of-concept (not 0-day), automatable=yes (SQL injection is easily scriptable), technical impact=total (SQL injection can leak, modify, or delete database contents). This is NOT a low-real-risk issue—it is actively exploitable with publicly available code. Organizations using Chat2DB in production should treat this as high-priority for authenticated threat models.

An internal database administrator or authenticated application user with low privileges logs into Chat2DB and uses the export table function. The attacker crafts a malicious table name, column name, or view name containing SQL injection payload (e.g., "table_name; DROP TABLE users; --"). When the administrator clicks 'Export Table,' the vulnerable exportTable() function constructs a SQL query by concatenating user input without sanitization. The injected SQL executes in the backend database context, potentially allowing the attacker to enumerate database schemas, exfiltrate sensitive data (customer PII, credentials), modify records, or delete critical tables. Because exploitation requires authentication (reducing blast radius to insider threats or compromised user accounts) but uses a public POC, automated tooling can quickly escalate privileges or pivot to database compromise once Chat2DB access is obtained. The low complexity (AC:L) and absence of user interaction (UI:N) make this easily repeatable in production environments.