[Security] High: Unrestricted SQL execution allows destructive operations (CWE-89, CVSS 7.0)

[Correctover]

Security Vulnerability Report

Severity: High (CVSS 7.0)
CWE: CWE-89 (SQL Injection)
Affected: mcp-database-server read_query and write_query tools

Summary

The read_query and write_query MCP tools accept and execute arbitrary SQL statements without permission controls, enabling destructive operations when the LLM agent is manipulated via prompt injection.

The tools pass user/agent-provided SQL directly to the database engine without:

• SQL syntax allowlisting (e.g., only SELECT for read operations)
• Permission-based access control
• Statement type validation
• Query parameterization enforcement

Impact

When combined with prompt injection attacks on the LLM agent:

1. Execute DROP TABLE, TRUNCATE, or DELETE FROM to destroy data
2. Use SELECT with subqueries to exfiltrate sensitive data from other tables
3. In databases supporting command execution (e.g., PostgreSQL COPY ... PROGRAM), this can escalate to OS-level RCE

Suggested Fix

1. Implement separate read-only and read-write connection pools with database-level permissions
2. For read_query, enforce SELECT-only validation
3. Implement query parameterization for all user-supplied values
4. Add query result size limits to prevent data exfiltration
5. Consider implementing an allowlist of permitted query patterns

Credits

Reported by Guigui Wang / Correctover — Runtime Verification for Agent Systems

---

This report follows responsible disclosure practices. Specific code locations are not disclosed publicly. I'm happy to share details privately with maintainers.