{"id":"CVE-2023-7299","summary":"DataGear resolveSql sql injection","details":"A vulnerability was found in DataGear up to 4.60. It has been declared as critical. This vulnerability affects unknown code of the file /dataSet/resolveSql. The manipulation of the argument sql leads to sql injection. The attack can be initiated remotely. Upgrading to version 4.7.0 is able to address this issue. It is recommended to upgrade the affected component.","modified":"2026-09-04T03:30:58.279669896Z","published":"2024-11-23T13:00:15.959Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"4.8"},{"last_affected":"4.8"},{"introduced":"4.9"},{"last_affected":"4.9"},{"introduced":"4.10"},{"last_affected":"4.10"},{"introduced":"4.11"},{"last_affected":"4.11"},{"introduced":"4.12"},{"last_affected":"4.12"},{"introduced":"4.13"},{"last_affected":"4.13"},{"introduced":"4.14"},{"last_affected":"4.14"},{"introduced":"4.15"},{"last_affected":"4.15"},{"introduced":"4.16"},{"last_affected":"4.16"},{"introduced":"4.17"},{"last_affected":"4.17"},{"introduced":"4.18"},{"last_affected":"4.18"},{"introduced":"4.19"},{"last_affected":"4.19"},{"introduced":"4.20"},{"last_affected":"4.20"},{"introduced":"4.21"},{"last_affected":"4.21"},{"introduced":"4.22"},{"last_affected":"4.22"},{"introduced":"4.23"},{"last_affected":"4.23"},{"introduced":"4.24"},{"last_affected":"4.24"},{"introduced":"4.25"},{"last_affected":"4.25"},{"introduced":"4.26"},{"last_affected":"4.26"},{"introduced":"4.27"},{"last_affected":"4.27"},{"introduced":"4.28"},{"last_affected":"4.28"},{"introduced":"4.29"},{"last_affected":"4.29"},{"introduced":"4.30"},{"last_affected":"4.30"},{"introduced":"4.31"},{"last_affected":"4.31"},{"introduced":"4.32"},{"last_affected":"4.32"},{"introduced":"4.33"},{"last_affected":"4.33"},{"introduced":"4.34"},{"last_affected":"4.34"},{"introduced":"4.35"},{"last_affected":"4.35"},{"introduced":"4.36"},{"last_affected":"4.36"},{"introduced":"4.37"},{"last_affected":"4.37"},{"introduced":"4.38"},{"last_affected":"4.38"},{"introduced":"4.39"},{"last_affected":"4.39"},{"introduced":"4.40"},{"last_affected":"4.40"},{"introduced":"4.41"},{"last_affected":"4.41"},{"introduced":"4.42"},{"last_affected":"4.42"},{"introduced":"4.43"},{"last_affected":"4.43"},{"introduced":"4.44"},{"last_affected":"4.44"},{"introduced":"4.45"},{"last_affected":"4.45"},{"introduced":"4.46"},{"last_affected":"4.46"},{"introduced":"4.47"},{"last_affected":"4.47"},{"introduced":"4.48"},{"last_affected":"4.48"},{"introduced":"4.49"},{"last_affected":"4.49"},{"introduced":"4.50"},{"last_affected":"4.50"},{"introduced":"4.51"},{"last_affected":"4.51"},{"introduced":"4.52"},{"last_affected":"4.52"},{"introduced":"4.53"},{"last_affected":"4.53"},{"introduced":"4.54"},{"last_affected":"4.54"},{"introduced":"4.55"},{"last_affected":"4.55"},{"introduced":"4.56"},{"last_affected":"4.56"},{"introduced":"4.57"},{"last_affected":"4.57"},{"introduced":"4.58"},{"last_affected":"4.58"},{"introduced":"4.59"},{"last_affected":"4.59"},{"introduced":"4.60"},{"last_affected":"4.60"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"VulDB","cwe_ids":["CWE-74","CWE-89"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/7xxx/CVE-2023-7299.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/7xxx/CVE-2023-7299.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-7299"},{"type":"ADVISORY","url":"https://vuldb.com/?id.285658"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.442943"},{"type":"REPORT","url":"https://github.com/datageartech/datagear/issues/29"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.285658"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/datageartech/datagear","events":[{"introduced":"2f65f3d115f9b2faefb97aacb864a88b6306173b"},{"fixed":"43c63d5f66a69584188e14088ccb6c9557eb9f50"}],"database_specific":{"cpe":"cpe:2.3:a:datagear:datagear:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.0"},{"last_affected":"4.0"},{"introduced":"4.1"},{"last_affected":"4.1"},{"introduced":"4.2"},{"last_affected":"4.2"},{"introduced":"4.3"},{"last_affected":"4.3"},{"introduced":"4.4"},{"last_affected":"4.4"},{"introduced":"4.5"},{"last_affected":"4.5"},{"introduced":"4.6"},{"last_affected":"4.6"},{"introduced":"4.7"},{"last_affected":"4.7"},{"introduced":"0"},{"fixed":"4.7.0"}],"source":["AFFECTED_FIELD","CPE_RANGE"]}}],"versions":["4.0","4.1","4.2","4.3","4.4","4.5","4.6","4.7","v4.6.0","v4.5.1","v4.5.0","v4.4.0","v4.3.1","v4.3.0","v4.2.0","v4.1.1","v4.1.0","v4.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-7299.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N"}]}