CVE-2025-24787: WhoDB allows parameter injection in DB connection URIs leading to local file inclusion
(updated )
The application is vulnerable to parameter injection in database connection strings, which allows an attacker to read local files on the machine the application is running on.
References
- github.com/advisories/GHSA-c7w4-9wv8-7x7c
- github.com/clidey/whodb
- github.com/clidey/whodb/commit/8d67b767e00552e5eba2b1537179b74bfa662ee1
- github.com/clidey/whodb/security/advisories/GHSA-c7w4-9wv8-7x7c
- github.com/go-sql-driver/mysql/blob/7403860363ca112af503b4612568c3096fecb466/infile.go
- nvd.nist.gov/vuln/detail/CVE-2025-24787
Code Behaviors & Features
Detect and mitigate CVE-2025-24787 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →