Netmaker makes networks with WireGuard. Prior to version 1.5.0, the `sqliteDeleteRecord` function in Netmaker's database layer constructs SQL `DELETE` statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection. Version 1.5.0 fixes the issue.

Affected: Go: github.com/gravitl/netmaker

# SQL Injection in Netmaker SQLite Database Backend

## Summary

The `sqliteDeleteRecord` function in Netmaker's database layer constructs SQL `DELETE` statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform **boolean-based SQL injection**.

---

## Details

The endpoint:

DELETE /api/dns/{network}/{domain}

passes user-controlled path parameters through the following flow:

logic.DeleteDNS → database.DeleteRecord → sqliteDeleteRecord

Depending on the configured database backend, the request eventually reaches the SQLite database implementation.

### Vulnerable Code

The SQL query is constructed using direct string concatenation without parameterization.

```go // database/sqlite.go deleteSQL := "DELETE FROM " + tableName + " WHERE key = \"" + key + "\""

The key value originates from user input ({domain} path parameter) and is embedded directly into the SQL query.

Exploitation

An authenticated attacker can inject SQL operators into the {domain} path parameter to manipulate the query logic.

Because this injection is boolean-based, attackers extract data indirectly by observing the outcome of the operation:

If the injected condition evaluates true, the DNS record is deleted.

If the condition evaluates false, the DNS record remains.

By repeating this process, an attacker can infer information such as:

Database table names

Column names

Column values

Value lengths

Impact

An authenticated attacker can…