CVE-2023-31038

SQL injection in Log4cxx when using the ODBC appender to send log messages to a database.  No fields sent to the database were properly escaped for SQL injection.  This has been the case since at least version 0.9.0(released 2003-08-06) Note that Log4cxx is a C++ framework, so only C++ applications are affected. Before version 1.1.0, the ODBC appender was automatically part of Log4cxx if the library was found when compiling the library.  As of version 1.1.0, this must be both explicitly enabled in order to be compiled in. Three preconditions must be met for this vulnerability to be possible: 1. Log4cxx compiled with ODBC support(before version 1.1.0, this was auto-detected at compile time) 2. ODBCAppender enabled for logging messages to, generally done via a config file 3. User input is logged at some point. If your application does not have user input, it is unlikely to be affected. Users are recommended to upgrade to version 1.1.0 which properly binds the parameters to the SQL statement, or migrate to the new DBAppender class which supports an ODBC connection in addition to other databases. Note that this fix does require a configuration file update, as the old configuration files will not configure properly.  An example is shown below, and more information may be found in the Log4cxx documentation on the ODBCAppender. Example of old configuration snippet: <appender name="SqlODBCAppender" class="ODBCAppender">     <param name="sql" value="INSERT INTO logs (message) VALUES ('%m')" />     ... other params here ... </appender> The migrated configuration snippet with new ColumnMapping parameters: <appender name="SqlODBCAppender" class="ODBCAppender">     <param name="sql" value="INSERT INTO logs (message) VALUES (?)" />     <param name="ColumnMapping" value="message"/>     ... other params here ... </appender>

• CWE-89

• https://lists.apache.org/thread/vgjlpdf353vv91gryspwxrzj6p0fbjd9Exploit, Mailing List, Vendor Advisory
• https://lists.apache.org/thread/vgjlpdf353vv91gryspwxrzj6p0fbjd9Exploit, Mailing List, Vendor Advisory

Published

May 8, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-31032NVIDIA DGX A100 SBIOS contains a vulnerability where a user …5.5
• CVE-2023-31033NVIDIA DGX A100 BMC contains a vulnerability where a user ma…8
• CVE-2023-31034NVIDIA DGX A100 SBIOS contains a vulnerability where a local…7.8
• CVE-2023-31035NVIDIA DGX A100 SBIOS contains a vulnerability where an atta…7.8
• CVE-2023-31036NVIDIA Triton Inference Server for Linux and Windows contain…8.8
• CVE-2023-31037 NVIDIA Bluefield 2 and Bluefield 3 DPU BMC contains a vulne…7.2
• CVE-2023-31039Security vulnerability in Apache bRPC <1.5.0 on all platform…9.8
• CVE-2023-3104Lack of authentication vulnerability. An unauthenticated loc…7.5
• CVE-2023-31041An issue was discovered in SysPasswordDxe in Insyde InsydeH2…7.5
• CVE-2023-31042A flaw exists in FlashBlade Purity whereby an authenticated …4.3
• CVE-2023-31043EnterpriseDB EDB Postgres Advanced Server (EPAS) before 14.6…7.5
• CVE-2023-31044An issue was discovered in Nokia Impact before Mobile 23_FP1…8.8