Exploitation Summary
EIP tracks 1 public exploit for CVE-2014-8681. PoCs published by Timo Schmid.
AI-analyzed exploit summary This document details a blind SQL injection vulnerability in Gogs (Go Git Service) affecting versions >= v0.3.1-9-g49dc57e and <= v0.5.6.1024-gf1d8746. The vulnerability arises from improper string concatenation in the SQL query within the `models/issue.go` file, specifically in the `GetIssues` function, allowing attackers to inject malicious SQL via the `labelIds` parameter.
Description
SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remote attackers to execute arbitrary SQL commands via the label parameter to user/repos/issues.
Exploits (1)
This document details a blind SQL injection vulnerability in Gogs (Go Git Service) affecting versions >= v0.3.1-9-g49dc57e and <= v0.5.6.1024-gf1d8746. The vulnerability arises from improper string concatenation in the SQL query within the `models/issue.go` file, specifically in the `GetIssues` function, allowing attackers to inject malicious SQL via the `labelIds` parameter.