CyberRota Analysis
AI-GeneratedThe sqlparse module for Python is vulnerable in versions prior to 0.6.0, where it fails to properly escape backslashes in its output formats for Python and PHP. This flaw allows crafted SQL inputs to inject arbitrary code, posing a risk of code execution when the generated output is processed by downstream applications. Developers and organizations utilizing sqlparse in their projects should prioritize upgrading to version 0.6.0 to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and output_format='php' and the corresponding sqlformat -l modes, allowing crafted SQL to terminate the generated string and inject Python or PHP code when a downstream consumer executes or imports the generated source. This issue is fixed in version 0.6.0.