PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-8868] Cooking an SQL Injection Vulnerability in Chef Automate

xbow.com | vulnerability | High | CVE-2025-8868 | #vulnerability-research | #devops | #sql-injection | #postgresql | #default-credentials | #chef-automate
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Details an SQL injection in Chef Automate found via a little-known default data-collector token, letting authenticated attackers run arbitrary SQL against its PostgreSQL database.
CVE
CVE-2025-8868
CVSS
8.8
Published
Collected

Related coverage

vulnerability · horizon3.ai
[CVE-2021-41765] Multiple Vulnerabilities in ResourceSpace
Advisory for CVE-2021-41765, a critical SQL injection vulnerability leading to remote code execution, by the Horizon3 red team.
vulnerability · horizon3.ai
CVE-2020-35700: Exploiting a Second-Order SQL Injection in LibreNMS < 21.1.0
# CVE-2020-35700: Exploiting a Second-Order SQL Injection in LibreNMS * * * ##### How can NodeZero help you? Let our experts walk you through a demonstration of NodeZero®, so you can see how to...
vulnerability · horizon3.ai
CVE-2020-29437: Authenticated SQL Injection in OrangeHRM < 4.6.0.1
OrangeHRM is software for Human Resource Management (HRM). In a routine audit of the open source version of OrangeHRM, we discovered a SQL injection…
vulnerability · swarm.ptsecurity.com
MyBB <= 1.8.31: Remote Code Execution Chain
A full exploit chain for MyBB <= 1.8.31: an SQL injection escalates to RCE when MyBB runs on PostgreSQL — pg_send_query allows stacked queries — with malicious templates executed by eval().
Critical · vulnerability · yeswehack.com
CVE-2026-9082: PostgreSQL SQL Injection in Drupal
A patch analysis of CVE-2026-9082 (SA-CORE-2026-004): a PostgreSQL-specific SQL injection in Drupal’s entity query subsystem where unsanitised array keys reach SQL, plus PoC paths and the fix.
vulnerability · slcyber.io
High Fidelity Detection Mechanism for php2shell (CVE-2026-109618 and CVE-2026-109619)
The research team releases an open source tool php2shell-scanner which contains a high fidelity scanning mechanism to check for CVE-2026-109618 and CVE-2026-109619 across hosts.
Back