Threats tagged 'ghsa-7w4j-532w-pgpj'

Zetetic SQLCipher versions before 4.15.0 contain an SQL injection vulnerability in the sqlcipher_export function. This function, used to copy data between databases, temporarily disables defensive restrictions for dynamic schema manipulation. A flaw in validating the source database name parameter allows crafted input to execute unauthorized SQL statements, potentially modifying the sqlite_schema table and causing database corruption. Version 4.15.0 introduces strict validation to prevent this bypass.