{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awsgidavwsgidav/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wsgidav:wsgidav:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-55509"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WsgiDAV (\u003c= 4.3.4)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WsgiDAV"],"content_html":"\u003cp\u003eThe WsgiDAV project contains a sample module named \u003ccode\u003eMySQLBrowserProvider\u003c/code\u003e that is vulnerable to blind SQL injection (CVE-2026-55509). The vulnerability stems from improper input sanitization where the record key provided in a URL request is directly concatenated into a SQL \u003ccode\u003eWHERE\u003c/code\u003e clause. While the provider is not enabled by default, deployments that explicitly configure it to back a share are exposed.\u003c/p\u003e\n\u003cp\u003eBecause the provider performs an existence check during standard \u003ccode\u003eGET\u003c/code\u003e requests, an attacker does not require authentication or write access to exploit the flaw. By injecting SQL conditions into the URL path, an attacker can use a boolean status-code oracle - where a successful query result or error returns a 500 status and a non-existent record returns a 404 - to perform bit-by-bit data extraction from the backing database. This allows for the exfiltration of sensitive table data reachable by the database user account configured in the provider.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a WsgiDAV instance exposing a share backed by \u003ccode\u003eMySQLBrowserProvider\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious URL path formatted as \u003ccode\u003e/db/\u0026lt;table_name\u0026gt;/\u0026lt;injected_sql_key\u0026gt;\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker uses a boolean SQL injection payload, such as \u003ccode\u003e0' OR (SELECT ASCII(MID((QUERY),1,1))\u0026gt;100) OR '1'='2\u003c/code\u003e in the key parameter.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eMySQLBrowserProvider\u003c/code\u003e receives the request and concatenates the injected string directly into the \u003ccode\u003eSELECT id FROM table WHERE id = '\u0026lt;injected_key\u0026gt;'\u003c/code\u003e query.\u003c/li\u003e\n\u003cli\u003eThe backend database executes the injected SQL.\u003c/li\u003e\n\u003cli\u003eThe application returns an HTTP 500 if the injected condition is true (due to internal state handling) or an HTTP 404 if false.\u003c/li\u003e\n\u003cli\u003eAttacker iteratively automates these requests to exfiltrate arbitrary data from the database.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to unauthorized access and exfiltration of sensitive information contained within the MySQL database linked to the WsgiDAV share. The scope of impact is limited to the privileges of the database user configured in the provider. As this is an unauthenticated vector on any share using the provider, it represents a high risk for data confidentiality in affected deployments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the remediation of any WsgiDAV instance utilizing the \u003ccode\u003eMySQLBrowserProvider\u003c/code\u003e.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDisable the \u003ccode\u003eMySQLBrowserProvider\u003c/code\u003e module in the WsgiDAV configuration if it is not strictly required.\u003c/li\u003e\n\u003cli\u003eUpgrade WsgiDAV to a version where this vulnerability is resolved.\u003c/li\u003e\n\u003cli\u003eImplement access control lists (ACLs) or web-level authentication for any share using the \u003ccode\u003eMySQLBrowserProvider\u003c/code\u003e to prevent unauthenticated access.\u003c/li\u003e\n\u003cli\u003eReview web access logs for requests to paths matching \u003ccode\u003e/db/*/*\u003c/code\u003e containing SQL syntax characters (e.g., \u003ccode\u003e'\u003c/code\u003e, \u003ccode\u003e--\u003c/code\u003e, \u003ccode\u003eUNION\u003c/code\u003e, \u003ccode\u003eSELECT\u003c/code\u003e).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-28T21:17:37Z","date_published":"2026-08-28T21:17:37Z","id":"https://feed.craftedsignal.io/briefs/2026-08-wsgidav-sql-injection/","summary":"The WsgiDAV MySQLBrowserProvider sample module is vulnerable to blind SQL injection via unsanitized URL input, allowing unauthenticated attackers to extract database content.","title":"Blind SQL Injection in WsgiDAV MySQLBrowserProvider","url":"https://feed.craftedsignal.io/briefs/2026-08-wsgidav-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:wsgidav:wsgidav:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}