CVE-2025-69285 (CNNVD-202601-3350)
中文标题:
SQLBot 访问控制错误漏洞
英文标题:
SQLBot uploadExcel Endpoint has Unauthenticated Arbitrary File Upload vulnerability
漏洞描述
中文描述:
SQLBot是DataEase开源的一个基于大模型和RAG的智能问数系统。 SQLBot 1.5.0之前版本存在访问控制错误漏洞，该漏洞源于/api/v1/datasource/uploadExcel端点缺少身份验证，可能导致未经身份验证的攻击者上传任意文件并注入数据到数据库。
英文描述:
SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.5.0 contain a missing authentication vulnerability in the /api/v1/datasource/uploadExcel endpoint, allowing a remote unauthenticated attacker to upload arbitrary Excel/CSV files and inject data directly into the PostgreSQL database. The endpoint is explicitly added to the authentication whitelist, causing the TokenMiddleware to bypass all token validation. Uploaded files are parsed by pandas and inserted into the database via to_sql() with if_exists='replace' mode. The vulnerability has been fixed in v1.5.0. No known workarounds are available.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| dataease | SQLBot | < 1.5.0 | - | - |
cpe:2.3:a:dataease:sqlbot:<_1.5.0:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
4.0 (cna)
HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-69285 |
2026-01-22 03:16:57 | 2026-01-21 22:00:07 |
| NVD | nvd_CVE-2025-69285 |
2026-01-22 02:00:05 | 2026-01-21 22:00:14 |
| CNNVD | cnnvd_CNNVD-202601-3350 |
2026-01-26 02:10:03 | 2026-01-25 18:11:55 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 授权问题
- cnnvd_id: 未提取 -> CNNVD-202601-3350
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']