Azure-Samples / Azure-Samples/SQL-AI-samples

[Security] SQL Injection Vulnerability in ListTableTool.ts (MssqlMcp/Node/src/tools)

Open
#92 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
HTML
Stars
331
Forks
208
PR merge metrics
No merged PRs in 30d

Description

## Summary
The `ListTableTool` class in the Node.js MCP sample is vulnerable to SQL injection attacks due to unsanitized user input being directly interpolated into a dynamic SQL query. This affects the `run()` method when filtering by schemas via the `parameters` array.

**Affected File:** [MssqlMcp/Node/src/tools/ListTableTool.ts](https://github.com/Azure-Samples/SQL-AI-samples/blob/main/MssqlMcp/Node/src/tools/ListTableTool.ts)

## Steps to Reproduce
1. Instantiate the `ListTableTool` and call `run()` with malicious input:
```json
{
"parameters": ["dbo'; SELECT name FROM sys.databases --"]
}

query becomes:
`SELECT TABLE_SCHEMA + '.' + TABLE_NAME FROM INFORMATION_SCHEMA.TABLES
WHERE TABLE_TYPE = 'BASE TABLE'
AND TABLE_SCHEMA IN ('dbo'; SELECT name FROM sys.databases --')
ORDER BY TABLE_SCHEMA, TABLE_NAME`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.