CVE-2023-43794

Nocodb is an open source Airtable alternative. Affected versions of nocodb contain a SQL injection vulnerability, that allows an authenticated attacker with creator access to query the underlying database. By supplying a specially crafted payload to the given an attacker can inject arbitrary SQL queries to be executed. Since this is a blind SQL injection, an attacker may need to use time-based payloads which would include a function to delay execution for a given number of seconds. The response time indicates, whether the result of the query execution was true or false. Depending on the result, the HTTP response will be returned after a given number of seconds, indicating TRUE, or immediately, indicating FALSE. In that way, an attacker can reveal the data present in the database. This vulnerability has been addressed in version 0.111.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-141`.

• CWE-89
• CWE-89

• https://github.com/nocodb/nocodb/security/advisories/GHSA-3m5q-q39v-xf8fExploit, Third Party Advisory
• https://github.com/nocodb/nocodb/security/advisories/GHSA-3m5q-q39v-xf8fExploit, Third Party Advisory

Published

Oct 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-43789A vulnerability was found in libXpm where a vulnerability ex…5.5
• CVE-2023-4379An issue has been discovered in GitLab EE affecting all vers…7.5
• CVE-2023-43790iTop is an IT service management platform. By manipulating …5.4
• CVE-2023-43791Label Studio is a multi-type data labeling and annotation to…8.8
• CVE-2023-43792baserCMS is a website development framework. In versions 4.6…9.8
• CVE-2023-43793Misskey is an open source, decentralized social media platfo…7.5
• CVE-2023-43795GeoServer is an open source software server written in Java …9.8
• CVE-2023-43796Synapse is an open-source Matrix homeserver Prior to version…5.3
• CVE-2023-43797BigBlueButton is an open-source virtual classroom. Prior to …5.4
• CVE-2023-43798BigBlueButton is an open-source virtual classroom. BigBlueBu…5.4
• CVE-2023-43799Altair is a GraphQL Client. Prior to version 5.2.5, the Alta…7.8
• CVE-2023-4380A logic flaw exists in Ansible Automation platform. Whenever…6.3