MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”)

Summary

CVE-2025-67510 affects the MySQLWriteTool in the Neuron PHP framework (versions 2.8.11 and below). The tool executes arbitrary SQL provided by the caller using PDO::prepare() and execute() without semantic restrictions [1][2]. While this behavior is intentional for legitimate database write operations, in the context of an LLM agent it becomes a high-risk capability [2][3].

Root

Cause and Exploitation

The vulnerability is rooted in the lack of semantic validation on SQL queries passed to the MySQLWriteTool [2]. An attacker can leverage prompt injection or indirect prompt manipulation to coerce the agent into executing destructive SQL commands [2][3]. The attack surface is agents exposed to untrusted input, such as public-facing chatbots or tools that process user-supplied prompts [2][3]. No additional authentication is required beyond the agent's existing database user permissions [2].

Impact

Successful exploitation can result in execution of arbitrary SQL statements including DROP TABLE, TRUNCATE, DELETE, ALTER, and privilege-related statements [2][3]. The actual impact depends on the database user's permissions – if the agent's DB user has broad privileges, an attacker could drop entire tables or modify database schemas [2]. This could lead to data loss, service disruption, or unauthorized data manipulation [2].

Mitigation

The issue is fixed in version 2.8.12 [2][3]. The commit [4] shows that the fix adds a keyword validation layer that rejects dangerous statements. Recommended workarounds include disabling MySQLWriteTool for untrusted agents, using a dedicated least-privilege DB user, and implementing application-layer policy to block high-risk SQL commands [3].