CVE-2026-4173

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-4173", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-14T15:03:38.828Z", "datePublished": "2026-03-15T09:02:08.163Z", "dateUpdated": "2026-03-17T13:20:49.751Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-15T09:02:08.163Z"}, "title": "CodePhiliaX Chat2DB Database Export DMDBManage.java updateProcedure sql injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "SQL Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "CodePhiliaX", "product": "Chat2DB", "versions": [{"version": "0.3.0", "status": "affected"}, {"version": "0.3.1", "status": "affected"}, {"version": "0.3.2", "status": "affected"}, {"version": "0.3.3", "status": "affected"}, {"version": "0.3.4", "status": "affected"}, {"version": "0.3.5", "status": "affected"}, {"version": "0.3.6", "status": "affected"}, {"version": "0.3.7", "status": "affected"}], "modules": ["Database Export Handler"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in CodePhiliaX Chat2DB up to 0.3.7. This vulnerability affects the function exportTable/exportTableColumnComment/exportView/exportProcedure/exportTriggers/exportTrigger/updateProcedure of the file DMDBManage.java of the component Database Export Handler. This manipulation causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-03-14T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-14T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-14T16:08:51.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Ana10gy (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/?id.351080", "name": "VDB-351080 | CodePhiliaX Chat2DB Database Export DMDBManage.java updateProcedure sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.351080", "name": "VDB-351080 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.769775", "name": "Submit #769775 | CodePhiliaX Chat2DB <=0.3.7 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/AnalogyC0de/public_exp/issues/21", "tags": ["exploit", "issue-tracking"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-17T13:20:39.491908Z", "id": "CVE-2026-4173", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T13:20:49.751Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-4173", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-17T13:20:39.491908Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T13:20:46.265Z"}}], "cna": {"title": "CodePhiliaX Chat2DB Database Export DMDBManage.java updateProcedure sql injection", "credits": [{"lang": "en", "type": "reporter", "value": "Ana10gy (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "CodePhiliaX", "modules": ["Database Export Handler"], "product": "Chat2DB", "versions": [{"status": "affected", "version": "0.3.0"}, {"status": "affected", "version": "0.3.1"}, {"status": "affected", "version": "0.3.2"}, {"status": "affected", "version": "0.3.3"}, {"status": "affected", "version": "0.3.4"}, {"status": "affected", "version": "0.3.5"}, {"status": "affected", "version": "0.3.6"}, {"status": "affected", "version": "0.3.7"}]}], "timeline": [{"lang": "en", "time": "2026-03-14T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-14T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-14T16:08:51.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.351080", "name": "VDB-351080 | CodePhiliaX Chat2DB Database Export DMDBManage.java updateProcedure sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.351080", "name": "VDB-351080 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.769775", "name": "Submit #769775 | CodePhiliaX Chat2DB <=0.3.7 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/AnalogyC0de/public_exp/issues/21", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A flaw has been found in CodePhiliaX Chat2DB up to 0.3.7. This vulnerability affects the function exportTable/exportTableColumnComment/exportView/exportProcedure/exportTriggers/exportTrigger/updateProcedure of the file DMDBManage.java of the component Database Export Handler. This manipulation causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "SQL Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-15T09:02:08.163Z"}}}, "cveMetadata": {"cveId": "CVE-2026-4173", "state": "PUBLISHED", "dateUpdated": "2026-03-17T13:20:49.751Z", "dateReserved": "2026-03-14T15:03:38.828Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-15T09:02:08.163Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["Database Export Handler"], "product": "Chat2DB", "vendor": "CodePhiliaX", "versions": [{"status": "affected", "version": "0.3.0"}, {"status": "affected", "version": "0.3.1"}, {"status": "affected", "version": "0.3.2"}, {"status": "affected", "version": "0.3.3"}, {"status": "affected", "version": "0.3.4"}, {"status": "affected", "version": "0.3.5"}, {"status": "affected", "version": "0.3.6"}, {"status": "affected", "version": "0.3.7"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw has been found in CodePhiliaX Chat2DB up to 0.3.7. This vulnerability affects the function exportTable/exportTableColumnComment/exportView/exportProcedure/exportTriggers/exportTrigger/updateProcedure of the file DMDBManage.java of the component Database Export Handler. This manipulation causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha encontrado una falla en CodePhiliaX Chat2DB hasta la versi\u00f3n 0.3.7. Esta vulnerabilidad afecta a la funci\u00f3n exportTable/exportTableColumnComment/exportView/exportProcedure/exportTriggers/exportTrigger/updateProcedure del archivo DMDBManage.java del componente Gestor de Exportaci\u00f3n de Base de Datos. Esta manipulaci\u00f3n provoca inyecci\u00f3n SQL. Es posible iniciar el ataque remotamente. El exploit ha sido publicado y puede ser utilizado. Se contact\u00f3 al proveedor con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-4173", "lastModified": "2026-06-17T10:56:06.807", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4173", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-17T13:20:39.491908Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:19:57.663", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/AnalogyC0de/public_exp/issues/21"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.351080"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.351080"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.769775"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-89"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.3.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.3.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.3.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.3.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.3.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.3.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.3.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.3.7"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Chat2DB", "source": "cna", "vendor": "CodePhiliaX"}, "product": "chat2db", "vendor": "codephiliax"}], "analysis": {"en": {"generated_at": "2026-03-17T16:52:32.755985+00:00", "value": {"mitigation_remediation": ["Apply the latest available patch for CodePhiliaX Chat2DB that removes the SQL injection flaw (>=0.3.8 if released).", "If an official patch is not yet available, restrict network access to the Database Export Handler endpoints to authenticated and authorized users only.", "Disable or temporarily remove the export and updateProcedure features until a patch is applied.", "Monitor application logs for suspicious activity that may indicate exploitation attempts.", "Consult the vendor for an official update or advisory and apply it as soon as it is released."], "summary": {"action": "Immediate Patch", "impact": "SQL Injection (Database Compromise)"}, "threat_synthesis": {"affected_systems": "CodePhiliaX:Chat2DB versions up to 0.3.7 are affected. The vulnerability resides in the Database Export Handler component, specifically the files DMDBManage.java and functions exportTable, exportTableColumnComment, exportView, exportProcedure, exportTriggers, exportTrigger, and updateProcedure.", "description_and_impact": "The vulnerability in CodePhiliaX Chat2DB, located in DMDBManage.java, allows an attacker to perform SQL injection through several export functions. The flaw permits remote manipulation of the SQL statements that the application constructs, potentially enabling the attacker to read, modify, or delete data stored in the database. This leads to a compromise of the confidentiality and integrity of database contents, and if exploited with higher privileges, could facilitate further escalation or denial\u2011of\u2011service conditions.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate severity, but the EPSS score of less than 1% shows that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; attackers can trigger the injection by accessing the exported actions via HTTP requests to the application. Although an exploit has been published, no official fix or patch is currently available, underscoring the need to mitigate the risk through available controls."}}}}, "created": "2026-03-16T09:21:57.903661+00:00", "updated": "2026-03-23T14:01:55.949034+00:00", "vendors": ["codephiliax", "codephiliax$PRODUCT$chat2db"]}