Executive brief
WsgiDAV's sample MySQL provider module is vulnerable to blind SQL injection when handling database record lookups. An attacker can craft malicious URLs to extract arbitrary data from the backing MySQL database without authentication. Since this provider is often exposed in read-only shares without login requirements, any user who can access the share—including anonymous attackers—can read sensitive database contents by using boolean-based SQL injection techniques.
Technical details
The MySQLBrowserProvider concatenates user-supplied record keys directly into SQL WHERE clauses without escaping, resulting in queries like `SELECT id FROM testdb.users WHERE id = '<key>'`. A single quote in the key breaks out of the string literal, allowing arbitrary SQL execution. The module's type-checking logic contains a typo (`INTT` instead of `INT`), causing all primary keys to use the quoted branch, making injection possible even for integer columns. The injectable key is evaluated during basic existence checks on GET requests, requiring no authentication, write access, or special HTTP methods. The vulnerability manifests as a status-code oracle: matching SQL conditions return HTTP 500, non-matching conditions return 404, enabling bit-by-bit data extraction. The advisory confirms successful extraction of database records using boolean-based binary search techniques. Patched in version 4.3.5.
Affected products
- mar10 WsgiDAV <= 4.3.4
Timeline
- 2026-06-27: disclosed
- 2026-08-28: advisory
- 2026-06-27: patched: Version 4.3.5 released