Error-based SQL injection in Apache Superset via sqlExpression/where parameters

The repository contains a 52-byte README naming CVE-2026-23980 and one substantial Python 3 program, `exploit.py`. It is a standalone, non-framework authenticated exploitation tool targeting Apache Superset versions before 6.0.0. The script uses `requests`, supports credential-, Bearer-token-, or cookie-based session setup, attempts CSRF-token acquisition, and interacts with Superset dataset and chart APIs. Its stated vulnerable sink is `/api/v1/chart/data`, where it abuses `sqlExpression` or `where` to cause database errors that disclose query results. The available code and command-line action references show capabilities beyond vulnerability detection: datasource discovery/brute forcing, database metadata enumeration, row counts, selected/all-table dumping, and SQL-oriented extraction. No reverse shell, persistence, malware delivery, or external command-and-control endpoint is present.

This repository is a small standalone Python exploit project for CVE-2026-23980, containing one substantive code file (exploit.py), a README, and a .gitignore. The exploit targets Apache Superset versions earlier than 6.0.0 and abuses authenticated access to the /api/v1/chart/data API to inject SQL through either the adhoc column sqlExpression field or the extras.where field. The code is not just a detector: it is an operational exploitation utility. It logs into Superset via /api/v1/security/login, retrieves a CSRF token from /api/v1/security/csrf_token/, and then uses an authenticated session to send crafted requests to the vulnerable chart/data endpoint. The exploit is designed for PostgreSQL-backed Superset deployments and uses error-based extraction by forcing PostgreSQL to cast attacker-controlled query results to INT, causing conversion errors that leak the selected value in the API response. A notable capability is bypassing Superset's adhoc subquery validation using PostgreSQL XML functions such as query_to_xml(), which hide FROM/JOIN clauses inside function arguments and evade token-based filtering. Based on the README and visible code structure, the tool supports: login and optional anonymous-access attempts, vulnerability checking, datasource enumeration, injection testing, raw SQL execution, database/table/column enumeration, row counting, selective dumping, dump-all behavior, threaded bulk scanning from a targets file, configurable proxy support, and extraction through either sqlExpression or where injection points. Repository structure is straightforward: README.md documents the vulnerability, exploitation workflow, examples, and references; exploit.py implements the CLI, session handling, output formatting, scanning, and extraction logic. The exploit appears purpose-built rather than framework-based, with a mature proof-of-use implementation but no generalized payload framework. Overall, this is a standalone authenticated web SQL injection exploit for Apache Superset that focuses on reconnaissance and data extraction from PostgreSQL through the vulnerable chart/data API.

Repository contains a small, focused exploit project with two files: a README and a single Python entry point, exploit.py. The script is a standalone operational exploit for CVE-2026-23980 affecting Apache Superset versions earlier than 6.0.0. It targets the web API endpoint /api/v1/chart/data and abuses attacker-controlled SQL placed into either the adhoc column sqlExpression field or the extras.where field. The exploit authenticates to Superset via /api/v1/security/login, optionally retrieves a CSRF token from /api/v1/security/csrf_token/, and then submits crafted chart/data requests to trigger backend SQL execution. The core capability is authenticated error-based SQL injection against PostgreSQL-backed Superset deployments. The payload pattern uses CAST((SELECT ...) AS INT) so PostgreSQL returns a type conversion error containing the selected string value, which the script parses from the API response. The README and code indicate support for a validation bypass using PostgreSQL XML functions such as query_to_xml(), allowing queries containing FROM/JOIN to evade Superset's adhoc subquery validation logic. This makes the exploit more than a simple detector: it can actively extract arbitrary scalar values and automate broader enumeration. Based on the visible code and README-described functionality, exploit.py includes session management, authentication handling, optional anonymous-access probing, datasource discovery, vulnerability testing, raw SQL execution, and database enumeration helpers for databases, tables, columns, counts, and row dumping. It also supports bulk scanning from a targets file, multithreading, proxying through an intercepting proxy, and configurable injection point selection. Overall, the repository's purpose is to provide a practical offensive proof-of-concept and data extraction tool for exploiting Superset's authenticated SQL injection flaw in real environments.