CVE Details
Basic Information
| Title | CVE-2025-51458 |
|---|---|
| Type | cve |
| Published | 2025-07-22T20:15:25 |
| Last Seen | 2025-07-22T20:26:00 |
| Modified | 2025-07-22T20:15:25 |
CVSS Information
| Base Score | 6.5 (MEDIUM) |
|---|---|
| Attack Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
AI Analysis
| AI Description | SQL Injection vulnerability in eosphoros-ai DB-GPT allows remote attackers to execute arbitrary SQL statements via crafted input to specific endpoints. |
|---|---|
| AI Severity | Medium |
| AI Vendor | Eosphoros-ai Community |
| AI Product | eosphoros-ai DB-GPT |
| AI Version | 0.7.0 |
Additional Information
| CVE List | CVE-2025-51458 |
|---|---|
| CWE List | CWE-89 |
| Bulletin Family | cve |
Description
SQL Injection in editor_sql_run and query_ex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary SQL statements via crafted input passed to the /v1/editor/sql/run or /v1/editor/chart/run endpoints, interacting with api_editor_v1.editor_sql_run, editor_chart_run, and datasource.rdbms.base.query_ex.