{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/sqlparse--0.6.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:sqlparse:sqlparse:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-112307"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["sqlparse (\u003c= 0.6.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe sqlparse library through version 0.6.0 contains a vulnerability categorized as PHP code injection. The issue arises within the OutputPHPFilter component, which improperly handles SQL input containing unescaped dollar signs. When an attacker provides a SQL string containing specific sequences such as ${expr} or {${expr}}, the filter incorrectly embeds these into double-quoted PHP strings. If the application environment subsequently executes the resulting snippet as PHP code, it allows for arbitrary code execution. This vulnerability is critical for applications that dynamically generate PHP code snippets from untrusted SQL input using this library. Defenders should note that the impact depends heavily on whether the downstream application executes the output generated by the vulnerable filter.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary PHP code within the context of the application server. This could lead to full application compromise, data exfiltration, or lateral movement within the network. The scope affects any application utilizing sqlparse to transform SQL into PHP-executable strings using the vulnerable OutputPHPFilter.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade sqlparse to a version later than 0.6.0 where the improper handling of dollar signs in OutputPHPFilter is resolved.\u003c/li\u003e\n\u003cli\u003eAudit all application code that utilizes sqlparse.OutputPHPFilter to determine if the generated output is evaluated or executed as PHP.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation on all SQL queries that are processed by the sqlparse library to ensure they do not contain untrusted or unexpected dollar sign sequences.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T18:11:33Z","date_published":"2026-10-19T18:11:33Z","id":"https://feed.craftedsignal.io/briefs/2026-10-sqlparse-injection/","summary":"A vulnerability in sqlparse versions 0.6.0 and earlier allows for PHP code injection via unescaped dollar sign sequences in SQL input processed by OutputPHPFilter.","title":"PHP Code Injection in sqlparse","url":"https://feed.craftedsignal.io/briefs/2026-10-sqlparse-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Sqlparse (\u003c= 0.6.0)","version":"https://jsonfeed.org/version/1.1"}