Archerydms Archery

Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time and stop_time parameters in the my2sql interface.

Archery v1.7.5 to v1.8.5 was discovered to contain a SQL injection vulnerability via the where parameter at /archive/apply.

Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the kill_session interface. The project has released an update, please upgrade to v1.9.0 and above.

Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the report module.

Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the create_kill_session interface.

Archery v1.4.5 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_file, end_file, start_time, and stop_time parameters in the binlog2sql interface.

Archery v1.10.0 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.

SQL injection in data_dictionary.py table_info method in Archery - GHSL-2022-106

Multiple SQL injections in sql/instance.py param_edit method in Archery - GHSL-2022-104

SQL injection in sql/instance.py endpoint in Archery - GHSL-2022-101

Multiple SQL injections in sql_api/api_workflow.py endpoint in Archery - GHSL-2022-102

SQL injection in sql_api/api_workflow.py endpoint in Archery - GHSL-2022-103

SQL injection in sql_optimize.py explain method in Archery - GHSL-2022-108

SQL injection in sql_optimize.py optimize_sqltuningadvisor method in Archery - GHSL-2022-107

Multiple SQL injections in sql/data_dictionary.py table_list method in Archery - GHSL-2022-105