Attack Chain

1. An unauthenticated attacker connects to the exposed Anyquery MySQL-compatible server port (e.g., 8070).
2. The attacker executes an ATTACH DATABASE SQL command to specify a new SQLite database file and a sensitive target path on the victim's filesystem (e.g., /etc/cron.d/pwn or /var/www/html/shell.php).
3. The attacker creates a table within the newly attached database using CREATE TABLE.
4. The attacker injects a malicious payload (e.g., a reverse shell command for a cronjob, or PHP system() function for a web shell) into the table using an INSERT INTO SQL command.
5. Anyquery writes the SQLite database file containing the malicious payload to the specified sensitive path.
6. A system service (e.g., cron daemon, web server) attempts to process the newly created file, ignoring the SQLite binary header and parsing the valid injected malicious code.
7. The malicious code (e.g., reverse shell, web shell commands) is executed with the privileges of the Anyquery process, leading to Remote Code Execution.

Impact

This vulnerability carries a CVSS score of 9.1 (Critical), indicating high severity. If exploited, the integrity of the affected system is severely compromised as arbitrary files can be written or overwritten, potentially corrupting critical system data. Availability is also highly impacted, as overwriting essential system files or configurations can lead to a complete Denial of Service (DoS). When Anyquery runs with elevated privileges (e.g., as root) or can write to critical directories like web roots or cronjob folders, the AFW escalates directly to Remote Code Execution (RCE) with a CVSS score of 9.8 (Critical), allowing full system compromise, persistence, and potential privilege escalation.

Recommendation

• Patch CVE-2026-50006 by upgrading Anyquery to version 0.4.5 or later immediately.
• Deploy the Sigma rules in this brief to your SIEM and tune for your environment to detect suspicious file creations by the anyquery process.
• Enable file_event logging for Linux endpoints to capture file creations in sensitive directories like /etc/cron.d/ and /var/www/html/.
• Enable process_creation logging to monitor for suspicious anyquery process command-line arguments, especially --host 0.0.0.0.