Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2025-8868] Cooking an SQL Injection Vulnerability in Chef Automate

xbow.com | vulnerability | High | CVE-2025-8868 | #vulnerability-research | #devops | #sql-injection | #postgresql | #default-credentials | #chef-automate

Summary

Details an SQL injection in Chef Automate found via a little-known default data-collector token, letting authenticated attackers run arbitrary SQL against its PostgreSQL database.
CVSS
8.8
Published
Collected

original ↗

Related coverage

  1. MyBB <= 1.8.31: Remote Code Execution Chain (swarm.ptsecurity.com)
  2. CVE-2023-25157 PoC: GeoServer jsonArrayContains SQL injection to PostgreSQL RCE (gist.github.com)
  3. CVE-2026-17543 PoC: PHP ext-pgsql SQL injection via backslash breakout (github.com)
  4. CVE-2026-8054 — dotCMS Core Publish Audit API SQL Injection (aretiq.ai)
  5. When the Heat Gets to Your Database: A Refreshing SQL Injection Discovery in Z-Push (xbow.com)
  6. Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898 (bishopfox.com)

back