Stirling-PDF Database Import SQL Injection Leads to Command Execution

Stirling-PDF, a locally hosted web application for PDF operations, is affected by a SQL injection vulnerability in its database import feature.

Before version 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database. The DatabaseService.validateSqlContent() function splits normalized input on semicolons and accepts a statement when it contains any allowed keyword, allowing dangerous H2 functions such as FILE_READ and CSVWRITE, plus CREATE ALIAS, to bypass the insufficient whitelist and execute side effects when RUNSCRIPT processes the file.

• Impact: arbitrary file access.
• Demonstrated impact: operating-system command execution as the JVM service account by writing attacker-controlled startup files and triggering an application Python interpreter configured to load them.
• Fixed in version 2.13.2.