CVE-2022-3798: SQL Injection Vulnerability in go-ibax
Summary
CVE-2022-3798: IBAX go-ibax vulnerable to SQL injection. Affects github.com/IBAX-io/go-ibax versions < 1.4.2. Fixed in 1.4.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
go-ibax is an open-source package written in Go that is used for IBAX blockchain development. It provides various functionalities for building decentralized applications on the IBAX platform. However, a critical vulnerability has been discovered in go-ibax that allows for SQL injection attacks.
Vulnerability Detail
The vulnerability exists in an unknown function of the file /api/v2/open/tablesInfo. It can be exploited remotely and leads to SQL injection. An attacker can manipulate the input to execute arbitrary SQL queries, potentially gaining unauthorized access to the database or performing other malicious actions. The vulnerability has been assigned the identifier CVE-2022-3798 and has a CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It has been disclosed publicly and can be actively exploited.
How To Fix
Latest published version: v1.4.6 as of 23 Oct 2026
go get github.com/IBAX-io/go-ibax@v1.4.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.2
This is the first release that contains the fix.
go get github.com/IBAX-io/go-ibax@v1.4.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched version of go-ibax to mitigate the risk of SQL injection attacks.
Conclusion
The go-ibax package is vulnerable to a critical SQL injection vulnerability. To protect your application, it is crucial to update to go-ibax version 1.4.2 or later. This update includes a patch that addresses the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/IBAX-io/go-ibax →
FAQ
go-ibax is an open-source package used for IBAX blockchain development. It provides functionalities for building decentralized applications on the IBAX platform.
SQL injection is a type of vulnerability that allows an attacker to manipulate SQL queries by injecting malicious input. This can lead to unauthorized access to the database or other malicious actions.
The vulnerability can be exploited remotely by manipulating the input to the /api/v2/open/tablesInfo function. An attacker can execute arbitrary SQL queries and potentially gain unauthorized access to the database.
The CVSS score of this vulnerability is 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Yes, a fix is available in go-ibax version 1.4.2 or later. It is recommended to update to this version to mitigate the risk of SQL injection attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/IBAX-io/go-ibax.
