Null-Sec124

**Name of the Vulnerable Software and Affected Versions** SQLBot versions prior to 1.9.0 **Description** The system improperly handles multipart filename data when processing uploads. Specifically, the 'POST /api/v1/datasource/parseExcel' endpoint writes uploaded content to disk before completing spreadsheet parsing and validation. This allows an attacker to use a double-extension filename to save a Python source file into the `/opt/sqlbot/app/alembic/versions/` directory. Because the file remains on disk even if the parsing process fails, subsequent application startup or migration processing triggers Alembic to import the module and execute its statements within the application runtime. **Recommendations** Update SQLBot to version 1.9.0. Restrict access to the 'POST /api/v1/datasource/parseExcel' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SQLBot versions prior to 1.9.0 **Description** An authenticated uploader can upload an image/svg+xml assistant UI logo via the 'PATCH /api/v1/system/assistant/ui' endpoint. The system stores the SVG without sanitizing or validating embedded active content. The file is subsequently served inline from the same application origin through the 'GET /api/v1/system/assistant/picture/{filename}' endpoint. When another user loads this resource, embedded JavaScript executes within the web application context, leading to stored cross-site scripting (XSS), which allows access to the data and actions of the victim's session. **Recommendations** Update to version 1.9.0.

**Name of the Vulnerable Software and Affected Versions** SQLBot versions prior to 1.9.0 **Description** An issue exists where the `POST /api/v1/datasource/previewData` endpoint incorporates the client-controlled `table name` value into generated SQL without safe identifier handling. An authenticated user can configure a datasource for the internal PostgreSQL service and submit a crafted `table name` to invoke functions such as `pg read file()`, `pg read binary file()`, or `pg ls dir()`, while remaining a SELECT operation under the read-only policy. In default trusted loopback authentication configurations, the internal connection may execute with PostgreSQL superuser privileges, allowing the retrieval of filesystem content, including `/etc/hosts` and `/etc/passwd`, potentially exposing configuration, credentials, authentication secrets, and source code. **Recommendations** Update to version 1.9.0. Avoid using the `table name` parameter in the `POST /api/v1/datasource/previewData` endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** SQLBot versions prior to 1.9.0 **Description** SQLBot is a Text-to-SQL system utilizing large language models and Retrieval-Augmented Generation (RAG). An authenticated user can submit a crafted `tableName` value within the Excel datasource configuration via the 'POST /api/v1/datasource/' endpoint. The system stores this value without proper identifier handling. When the datasource is subsequently deleted using the 'DELETE /api/v1/datasource/{id}' endpoint, the stored value is interpolated into the cleanup SQL and executed by PostgreSQL. This second-order SQL injection allows the invocation of the PostgreSQL COPY TO PROGRAM command, enabling the execution of arbitrary operating-system commands with the privileges of the postgres process within the SQLBot container. **Recommendations** Update to version 1.9.0.