Anyquery Arbitrary File Write (AFW) Leads to Remote Code Execution (RCE)

A critical vulnerability (CVE-2026-50006) has been identified in Anyquery versions prior to 0.4.5, specifically when the application is operating in server mode. Unauthenticated attackers can leverage this flaw by connecting to the exposed MySQL-compatible server port. The vulnerability stems from Anyquery's failure to restrict SQLite's ATTACH DATABASE command, allowing adversaries to write arbitrary files to the underlying filesystem. This Arbitrary File Write (AFW) can be exploited to achieve Remote Code Execution (RCE) by dropping malicious files such as PHP web shells into web server directories or injecting cronjob entries into system directories like /etc/cron.d. This means an attacker can gain control over the affected system with the privileges of the running Anyquery process, posing a severe threat to data integrity and system availability.

Attack Chain

1. An unauthenticated attacker connects to the exposed Anyquery MySQL-compatible server port (e.g., 8070).
2. The attacker executes an ATTACH DATABASE SQL command to specify a new SQLite database file and a sensitive target path on the victim's filesystem (e.g., /etc/cron.d/pwn or /var/www/html/shell.php).
3. The attacker creates a table within the newly attached database using CREATE TABLE.
4. The attacker injects a malicious payload (e.g., a reverse shell command for a cronjob, or PHP system() function for a web shell) into the table using an INSERT INTO SQL command.
5. Anyquery writes the SQLite database file containing the malicious payload to the specified sensitive path.
6. A system service (e.g., cron daemon, web server) attempts to process the newly created file, ignoring the SQLite binary header and parsing the valid injected malicious code.
7. The malicious code (e.g., reverse shell, web shell commands) is executed with the privileges of the Anyquery process, leading to Remote Code Execution.

Impact

This vulnerability carries a CVSS score of 9.1 (Critical), indicating high severity. If exploited, the integrity of the affected system is severely compromised as arbitrary files can be written or overwritten, potentially corrupting critical system data. Availability is also highly impacted, as overwriting essential system files or configurations can lead to a complete Denial of Service (DoS). When Anyquery runs with elevated privileges (e.g., as root) or can write to critical directories like web roots or cronjob folders, the AFW escalates directly to Remote Code Execution (RCE) with a CVSS score of 9.8 (Critical), allowing full system compromise, persistence, and potential privilege escalation.

Recommendation

• Patch CVE-2026-50006 by upgrading Anyquery to version 0.4.5 or later immediately.
• Deploy the Sigma rules in this brief to your SIEM and tune for your environment to detect suspicious file creations by the anyquery process.
• Enable file_event logging for Linux endpoints to capture file creations in sensitive directories like /etc/cron.d/ and /var/www/html/.
• Enable process_creation logging to monitor for suspicious anyquery process command-line arguments, especially --host 0.0.0.0.