CVE-2023-30605

Archery, an open-source SQL audit platform, has multiple SQL injections where the variable_name and variable_value parameters in the param_edit endpoint (sql/instance.py) are concatenated unsafely into queries by set_variable and get_variables in the MySQL and goInception engine code. With the required low-privilege account, an attacker can use these to query the databases Archery is connected to. The impact is confidentiality-oriented, and the CWE-89 root cause is textbook unsanitized concatenation.

The sharp edge here is what Archery is: an audit platform sits astride the databases it manages, so an injection in it is a pivot into potentially many connected backends rather than a single app's data. That said, it requires an authenticated account and it is an internal tooling platform, not an internet-exposed mass target, so the realistic threat is a low-privileged insider or a stolen tool credential abusing that central position.

Our angle is who holds accounts and how tightly Archery's own database connections are scoped. We would enumerate Archery users, restrict access to the platform to trusted operators, and review the privileges of the service accounts Archery uses to reach each connected database, because narrowing those permissions limits what a successful injection can actually pull. Patching to a fixed version plus least-privilege on the downstream connections is the combination that shrinks this.