Databasement
Monthly
Databasement instances before 1.8.2 allow an authenticated user to achieve remote code execution by injecting path-redirecting client options (such as mariadb-dump --result-file, -r, --tab, pg_dump --file, mongodump --out, or redis-cli --rdb/--eval) into the arguments passed to the backup dump binary. Shell quoting prevents classic OS command injection, but argument injection alone is sufficient: by directing the dump output to a web-served, PHP-executing path such as /app/public/index.php, the attacker writes code that the web server later executes. Authentication is required (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), publicly available exploit code exists, and success depends on the chosen output path being both web-accessible and interpretable as code; no evidence of confirmed active exploitation was provided.
Account takeover in Databasement before 1.7.14 allows an unauthenticated remote attacker who possesses a pending invitation link to load the acceptance page, wait until the legitimate invitee accepts, and then submit acceptance using the cached authorization to overwrite the account password and gain access to managed database credentials and secrets. The vendor-published CVSS 4.0 score is 9.1 (AV:N/AC:L/AT:P/PR:N/UI:N), while the independent assessment rates it CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N because exploitation requires a leaked or forwarded invitation link and a timing race rather than a default-open path. Exploitation status is no public exploit identified at time of analysis, and no CISA KEV status was provided.
Improper access control in David-Crty databasement up to and including 1.7.1 allows an authenticated low-privileged user to read snapshot records that belong outside their authorized organization or scope through the /api/v1/snapshots endpoint, where SnapshotPolicy.viewAny and SnapshotPolicy.view fail to enforce proper scoping. Because the CVSS vector carries PR:L, exploitation requires a valid account on a multi-user or multi-organization deployment, and the assessed impact is limited to low confidentiality with no integrity or availability effect (CVSS 4.0 base 5.3; independently assessed CVSS 3.1 5.3). Publicly available exploit code exists, and the flaw is fully addressed by upgrading to version 1.7.2, which hardens organization scoping.
Path traversal in David-Crty databasement up to 1.7.1 lets a high-privileged authenticated user escape the intended backup volume by supplying a crafted schema_name to the database-servers restore API endpoint, reaching filesystem locations outside the restore target. The attack is network-reachable but rated high-complexity and difficult to exploit, and its assessed impact is limited to low confidentiality, integrity and availability with no scope change. Publicly available exploit code exists, though there is no confirmed evidence of active exploitation; the issue is fixed in 1.7.2.
Databasement instances before 1.8.2 allow an authenticated user to achieve remote code execution by injecting path-redirecting client options (such as mariadb-dump --result-file, -r, --tab, pg_dump --file, mongodump --out, or redis-cli --rdb/--eval) into the arguments passed to the backup dump binary. Shell quoting prevents classic OS command injection, but argument injection alone is sufficient: by directing the dump output to a web-served, PHP-executing path such as /app/public/index.php, the attacker writes code that the web server later executes. Authentication is required (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), publicly available exploit code exists, and success depends on the chosen output path being both web-accessible and interpretable as code; no evidence of confirmed active exploitation was provided.
Account takeover in Databasement before 1.7.14 allows an unauthenticated remote attacker who possesses a pending invitation link to load the acceptance page, wait until the legitimate invitee accepts, and then submit acceptance using the cached authorization to overwrite the account password and gain access to managed database credentials and secrets. The vendor-published CVSS 4.0 score is 9.1 (AV:N/AC:L/AT:P/PR:N/UI:N), while the independent assessment rates it CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N because exploitation requires a leaked or forwarded invitation link and a timing race rather than a default-open path. Exploitation status is no public exploit identified at time of analysis, and no CISA KEV status was provided.
Improper access control in David-Crty databasement up to and including 1.7.1 allows an authenticated low-privileged user to read snapshot records that belong outside their authorized organization or scope through the /api/v1/snapshots endpoint, where SnapshotPolicy.viewAny and SnapshotPolicy.view fail to enforce proper scoping. Because the CVSS vector carries PR:L, exploitation requires a valid account on a multi-user or multi-organization deployment, and the assessed impact is limited to low confidentiality with no integrity or availability effect (CVSS 4.0 base 5.3; independently assessed CVSS 3.1 5.3). Publicly available exploit code exists, and the flaw is fully addressed by upgrading to version 1.7.2, which hardens organization scoping.
Path traversal in David-Crty databasement up to 1.7.1 lets a high-privileged authenticated user escape the intended backup volume by supplying a crafted schema_name to the database-servers restore API endpoint, reaching filesystem locations outside the restore target. The attack is network-reachable but rated high-complexity and difficult to exploit, and its assessed impact is limited to low confidentiality, integrity and availability with no scope change. Publicly available exploit code exists, though there is no confirmed evidence of active exploitation; the issue is fixed in 1.7.2.