Daptin vulnerabilities

Daptin is a headless CMS based on GraphQL/JSON-API. In versions prior to 0.11.4, the /aggregate/:typename endpoint accepted column and group query parameters that were passed without validation, allowing authenticated users to inject arbitrary SQL expressions.

An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions return true when the user ID matches but fail to reject the null/zero reference, enabling bypass.

In Daptin 0.10.3, the goqu.L function in server/resource/resource_aggregate.go of the Aggregate API component is vulnerable to SQL injection via manipulation of the column/group/order arguments. The attack can be initiated remotely and the exploit is publicly available.