Remote Code Execution via Blind Template Injection in SQLPad

CVE-2022-0944 is a critical vulnerability identified in SQLPad versions 6.10.0 and earlier, stemming from improper input handling during template processing. An authenticated attacker possessing administrative privileges can trigger a blind template injection by supplying a malicious payload to the /api/test-connection endpoint. Because SQLPad processes this input improperly, it results in remote code execution (RCE) on the underlying host operating system. Given the availability of multiple proof-of-concept exploits on public repositories as of August 2026, the risk of exploitation is elevated for any internet-facing or improperly segmented instances of SQLPad. Defenders should prioritize patching to version 6.10.1 or later to mitigate this risk.

Attack Chain

1. The attacker gains authenticated access to the SQLPad management console using valid administrator credentials.
2. The attacker navigates to the /api/test-connection endpoint, typically used to verify database connectivity.
3. The attacker crafts a malicious request body containing a template injection payload designed to interact with the server's shell.
4. The request is sent to the target server via an HTTP POST request.
5. The application parses the malicious payload in the request body, triggering the template injection vulnerability.
6. The server-side template engine executes the embedded shell commands (e.g., executing system binaries).
7. The command execution results in the attacker achieving unauthorized control over the server environment.

Impact

Successful exploitation allows for complete compromise of the SQLPad application server. Depending on the container or host configuration, this may result in full system-level access, exfiltration of stored database credentials, lateral movement within the network, or deployment of additional malicious payloads.

Recommendation

• Immediately patch all instances of SQLPad to version 6.10.1 or later.
• Restrict access to the SQLPad web interface and API endpoints using network segmentation or firewall rules, ensuring they are not exposed to the public internet.
• Monitor web server logs for HTTP POST requests to /api/test-connection that contain suspicious characters or strings indicative of template injection (e.g., shell metacharacters like backticks, pipes, or semicolons).
• Implement strict monitoring for unexpected process creation originating from the SQLPad application service account or container.