THREAT OPS › Threat News › [GHSA] GHSA-p6gw-4frg-j7jw (high) — WsgiDAV MySQL provider has a blind SQL injection
[GHSA] GHSA-p6gw-4frg-j7jw (high) — WsgiDAV MySQL provider has a blind SQL injection
GHSA-p6gw-4frg-j7jw Severity: high CVE: CVE-2026-55509
WsgiDAV MySQL provider has a blind SQL injection
### Summary
The sample `MySQLBrowserProvider` builds its SQL queries by concatenating strings, and the record key from the request URL goes straight into the WHERE clause with no escaping. Any user who can reach a share backed by this provider can inject SQL through the URL. Since these read
Indicators of compromise
- CVE-2026-55509cve
- http://127.0.0.1:8080/db/users/0%27%20OR%20%271%27%3D%271url
- http://127.0.0.1:8080/db/users/0%27%20OR%20%271%27%3D%272url
- http://127.0.0.1:8080/db/users/url
Original source: https://github.com/advisories/GHSA-p6gw-4frg-j7jw