CVE-2023-47128

CVE-2023-47128 is a critical SQL Injection vulnerability affecting Piccolo ORM versions prior to 1.1.1, specifically in its handling of named transaction savepoints. This flaw, rated 9.1 CVSS (CRITICAL), allows an unauthenticated attacker to execute arbitrary SQL commands with high impact on confidentiality and integrity, potentially leading to data theft, modification, or even server compromise. While direct exposure of the vulnerable parameter is unlikely, successful exploitation grants extensive database access. Currently, there is no evidence of active exploitation, and public exploit code is unavailable, though it has generated significant community discussion.