{"id":"CVE-2026-108963","published":"2026-10-11T20:16:32.853","lastModified":"2026-10-13T14:17:24.550","description":"databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly. NOTE: the project's composer.json file does not indicate an independently published databasement Composer package.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-88"],"vendors":[],"products":[],"references":[{"url":"https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/app/Services/Backup/Databases/MysqlDatabase.php#L22","tags":[]},{"url":"https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/composer.json#L3","tags":[]},{"url":"https://github.com/David-Crty/databasement/commit/22258e3eac594e653f9d04a69d93e83923d61499","tags":[]},{"url":"https://github.com/David-Crty/databasement/commit/2d2761905594a2fa2c3d81d48a7c8b6a1784862c","tags":[]},{"url":"https://github.com/David-Crty/databasement/security/advisories/GHSA-hm57-pvxc-4pcm","tags":[]}],"exploitRefs":[{"url":"https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/app/Services/Backup/Databases/MysqlDatabase.php#L22","tags":[]},{"url":"https://github.com/David-Crty/databasement/blob/bcee6f0e62796337aaac26961c41f7eb9578dd76/composer.json#L3","tags":[]},{"url":"https://github.com/David-Crty/databasement/commit/22258e3eac594e653f9d04a69d93e83923d61499","tags":[]},{"url":"https://github.com/David-Crty/databasement/commit/2d2761905594a2fa2c3d81d48a7c8b6a1784862c","tags":[]},{"url":"https://github.com/David-Crty/databasement/security/advisories/GHSA-hm57-pvxc-4pcm","tags":[]}],"hasPoc":true,"ai":{"summary":"The databasement library before version 1.8.2 allows authenticated users to inject OS commands through database names, enabling remote code execution by writing arbitrary PHP files to the web root. This occurs because the mariadb-dump command doesn't properly quote user-supplied database names, allowing attackers to inject additional commands.","exploitability":"Exploitation requires an authenticated user account with access to the database management interface, but is relatively straightforward once achieved as it leverages existing database dump functionality to write PHP code directly to the web server's document root.","blast_radius":"If exploited, attackers could execute arbitrary code on the web server, potentially leading to full system compromise, data exfiltration, or serving malicious content to other users.","remediation":"Upgrade to databasement version 1.8.2 or later to fix the OS command injection vulnerability in mariadb-dump functionality.","detection":"Monitor for unusual file creation patterns in the web root directory, particularly PHP files being written by the web server process, and examine application logs for database dump operations with unexpected arguments.","tags":["rce","command-injection","web","database"],"model":"garnet-coder","analyzedAt":"2026-10-16T08:52:12.350Z"}}