CVE-2026-33078
Roxy-WI is vulnerable to SQL injection via the 'server_ip' URL parameter.
- CVSS 8.9
- CWE-89
- Input Validation and Sanitization
- Remote
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 8.2.6.4 have a SQL injection vulnerability in the haproxy_section_save function in app/routes/config/routes.py. The server_ip parameter, sourced from the URL path, is passed unsanitized through multiple function calls and ultimately interpolated into a SQL query string using Python string formatting, allowing attackers to execute arbitrary SQL commands. Version 8.2.6.4 fixes the issue.
- CWE
- CWE-89
- CVSS base score
- 8.9
- Published
- 2026-04-24
- OWASP
- A03 Injection
- Orthogonal defect classification
- Checking
- Code defect classification
- Missing Check
- Category
- Input Validation and Sanitization
- Subcategory
- SQL Injection
- Accessibility scope
- Remote
- Impact
- Arbitrary Code Execution
- Affected component
- Roxy-WI
Solution
Upgrade Roxy-WI to version 8.2.6.4 or later.
Vulnerable code sample
# app/routes/config/routes.py
from flask import Flask, request
import sqlite3
app = Flask(__name__)
# This is a simplified mock of a database interaction function.
def a_db_update(sql_query):
# In a real scenario, this would connect to a database and execute the query.
# For this example, we just print the query to show the vulnerability.
print(f"Executing SQL: {sql_query}")
# connection = sqlite3.connect('roxywi.db')
# cursor = connection.cursor()
# cursor.execute(sql_query)
# connection.commit()
# This function represents an intermediate step in the call chain.
def update_section(server_ip, section_name, section_data):
# The unsanitized 'server_ip' is used to build a raw SQL query string.
# VULNERABILITY: server_ip is formatted directly into the query.
sql = f"UPDATE haproxy_cfg SET {section_name} = '{section_data}' WHERE server = '{server_ip}'"
a_db_update(sql)
# The main route handler where the vulnerability originates.
@app.route('/haproxy/section/save/<server_ip>', methods=['POST'])
def haproxy_section_save(server_ip):
# The 'server_ip' from the URL path is not sanitized.
# The request data would be read here in a real application.
section_name = "timeout_connect"
section_data = "5000"
# The unsanitized server_ip is passed to another function.
update_section(server_ip, section_name, section_data)
return "OK"Patched code sample
def representative_fix_for_sql_injection(db_cursor, server_ip: str, section: str, option: str, value: str):
"""
This function demonstrates the fix for the SQL injection vulnerability
described in CVE-2023-30778 (similar to the prompt's CVE-2026-33078).
The vulnerability was caused by inserting the 'server_ip' variable directly
into an SQL string. The fix is to use a parameterized query, where the
SQL command and the data are sent to the database engine separately.
"""
# VULNERABLE METHOD (DO NOT USE):
# The 'server_ip' is formatted directly into the query, allowing an attacker
# to inject malicious SQL commands (e.g., by passing an IP like "'; DROP TABLE users; --").
#
# vulnerable_sql = f"INSERT INTO {section} (server, `{option}`) VALUES ('{server_ip}', '{value}')"
# db_cursor.execute(vulnerable_sql)
# FIXED METHOD:
# The SQL string uses placeholders ('%s' for MySQL, '?' for SQLite).
# The actual values are passed as a separate tuple to the execute() method.
# The database driver safely handles the values, preventing injection.
# Note: Table and column names (section, option) cannot be parameterized
# and would need to be validated against an allow-list separately.
safe_sql = f"INSERT INTO {section} (server, `{option}`) VALUES (%s, %s)"
# The driver correctly escapes `server_ip` and `value`.
db_cursor.execute(safe_sql, (server_ip, value))Payload
'; SELECT pg_sleep(10); --Cite this entry
@misc{vaitp:cve202633078,
title = {{Roxy-WI is vulnerable to SQL injection via the 'server_ip' URL parameter.}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2026},
note = {VAITP Python Vulnerability Dataset, entry CVE-2026-33078},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-33078/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::