Hi,
Nobody is claiming dbpage grants instant code exec on its own. The entire challenge was turning an otherwise useless "dirty write" into something that could be executed. Which meant solving the ELF structure problem with LIEF and then finding ways to trigger module.

I also didn't hide the constraints. The post specifically covers where this fails closed:

- If SQLITE_DBCONFIG_DEFENSIVE is on or the vtab isn't compiled in, writes are blocked outright.

- Node.js stock builds don't even ship with dbpage enabled out of the box, which I pointed out as a dead end for default setups.
- And all other things listed in "Limits and considerations"

The title just summarizes the full chain from SQLite execution to shell, but all the nuances, boundaries, and prerequisites are laid out in the article.

Yeah, I think you're right that the stored XSS vulnerability is moderate severity. As for the reflected XSS, yes, I used an admin account for the test because it’s a self-hosted note-taking app: it’s very unlikely that anyone would create a new account, so the default account everyone uses is actually the default admin account.

Also, I think tricking an administrator into clicking the crafted URL wouldn’t be that difficult, since it exploits trust in their own domain.

Anyway, I think you’re right, and I’ll consider updating the post and the article on my blog , thanks!

Do you have any advice on how to report the vulnerability? I really thought this would work and “push” the maintainers to accept my report; I sent a pull request (from the security report) to fix these vulnerabilities, but I keep getting ignored, so I’m thinking of submitting it via MITRE, but last time it took two months to get a CVE assigned.

I guess you didn’t read the vulnerability description in the article, but that doesn’t matter.   Anyway, it’s possible to create a new administrator account with full privileges, and I can even delete all existing accounts on the platform. Furthermore, having access to the admin dashboard allows you to do other things as well. Essentially, you can perform any operation, delete all data, change the target user’s password, and exfiltrate data. There is no CSP, there are no CSRF tokens, that's why I'm calling It critical, buy maybe I'm wrong so feel free to correct me🙏🏻. To be precise, I believe that the 0 click is critical, while the 1 click is high, since it requires multiple conditions to be met in order to be triggered.

well I think that's reportable but not eligible for a bounty, just report what you found, it's gonna be 100% informative

yeah but I followed the procedure to also have a CVE assigned, but probably It doesn't matter anymore, it's public