Unauthenticated SQL-injection exposure in an archive interface
This record illustrates the durable SQL-injection rule: code should bind values separately from query structure, with database privileges sized for the smallest required task.
- Original severity
- P1 source-reported; not rescored by vulns.co
- Public source
- bugcrowd crowdstream
- Program / vendor
- National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
- Product / surface
- HEASARC W3Browse archive interface
- Weakness
- SQL injection · CWE-89
- Affected boundary
- Unauthenticated database-backed archive query surface
- Disclosure date
- 2026-07-13
- Public status checked
- 2026-09-10
- Public attribution
- Anon0x0
What the evidence established
The public summary states that the issue was accepted and resolved, with backend query execution as the claimed boundary.
Why the impact was credible
The source reported potential access to backend database content through arbitrary query execution.
Durable engineering lesson
This record illustrates the durable SQL-injection rule: code should bind values separately from query structure, with database privileges sized for the smallest required task.
Control pattern
Use parameterized queries, constrain query construction, and apply database permissions that limit a single endpoint's blast radius.
Primary public disclosure
Upstream availability and wording can change. Public status was last checked 2026-09-10.