CVE-2024-2562 is a medium severity (CVSS 6.3) SQL injection in PandaX up to the 20240310 build. The InsertRole function in role_menu.go builds a query from the roleKey argument unsafely. The record lists no fixed version, so check the project. The sections below cover how to check your exposure and what to do.
What's affected
PandaX up to 20240310, per the record, which uses a date style version. The affected function is InsertRole in /apps/system/services/role_menu.go and the argument is roleKey. The record links a GitHub issue on the project.
The NVD record scores it 6.3 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, published 2024-03-17. The weakness is classed as CWE-89 (SQL injection).
The record names no fixed version. It links an issue in the PandaXGO repository, not a release note, so check the project's commits after 10 March 2024 for a change to this function.
How to check if you're exposed
PandaX is a Go project, so check your build's commit date or the version you pulled:
git log -1 --format=%cd
grep -rn "roleKey" apps/system/services/role_menu.go
If your checkout is dated 10 March 2024 or earlier, it falls in the affected range.
What to do now
- Check the commit date of the PandaX build you run.
- Look at the project issue tracker and recent commits for a fix to InsertRole.
- Update to a build that contains a fix, or patch the query to use bound parameters.
- Limit the role management API to administrators on a trusted network.
- Review database logs for odd role key values.
Why it matters
The weakness is SQL injection. Input from the request is placed into a database query without being separated from the query structure, so a crafted value can change what the query does. Depending on the table and the database account, that means reading rows the user was never meant to see, changing records, or in some setups going further.
The reliable fix is the same in every language: parameterised queries, a database account with only the rights the page needs, and server-side validation of types. Filtering bad characters by hand tends to fail. If you run the application and no patched release exists, treat its code as something you must change yourself or take off the network.
This CVE is not on the CISA Known Exploited Vulnerabilities list (the record's KEV flag is false). Exploit details are not repeated here, because this guide is about defence.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages in a project and flags known vulnerabilities, and the Gold directory tracks this CVE. Reachability analysis helps decide which findings in your own code actually matter.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What does up to 20240310 mean?
PandaX uses a date based version, so every build dated on or before 10 March 2024 is affected according to the record.
Sources
Last reviewed: 19 October 2026.
