CVE-2022-3801: SQL Injection Vulnerability in go-ibax
Summary
CVE-2022-3801: IBAX go-ibax vulnerable to SQL injection. Affects github.com/IBAX-io/go-ibax versions < 1.4.2. Fixed in 1.4.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
go-ibax is an open-source package written in Go that is used for IBAX blockchain development. It provides various functionalities for building decentralized applications on the IBAX platform. However, a critical vulnerability has been discovered in go-ibax that allows for SQL injection attacks.
Vulnerability Detail
The vulnerability exists in the /api/v2/open/rowsInfo endpoint of go-ibax. By manipulating the argument order, an attacker can inject malicious SQL queries, leading to unauthorized access and potential data leakage. This vulnerability has been classified as critical with a CVSS score of 8.8. It can be exploited remotely, making it a significant security concern. The vulnerability has been assigned the identifier CVE-2022-3801 and is publicly disclosed, increasing the risk of exploitation.
How To Fix
Latest published version: v1.4.6 as of 23 Oct 2026
go get github.com/IBAX-io/go-ibax@v1.4.6Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.2
This is the first release that contains the fix.
go get github.com/IBAX-io/go-ibax@v1.4.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The SQL injection vulnerability in go-ibax poses a significant security risk to applications using this package. It is crucial to update to the latest version of go-ibax (1.4.2 or later) to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/IBAX-io/go-ibax →
FAQ
go-ibax is an open-source package used for IBAX blockchain development. It provides tools and functionalities for building decentralized applications on the IBAX platform.
The vulnerability allows for SQL injection attacks, which can lead to unauthorized access and potential data leakage. It poses a significant security risk to applications using go-ibax.
Yes, the vulnerability can be exploited remotely, making it a serious concern for applications using go-ibax.
Yes, a fix has been released in go-ibax version 1.4.2. It is recommended to update to this version or later to mitigate the vulnerability.
The CVSS score of this vulnerability is 8.8, indicating its high severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/IBAX-io/go-ibax.
