PT-2018-16175 · Unknown · Query-Mysql

Bl4De + 1 · Publicado 2018-07-03 · Atualizado 2018-09-10 · CVE-2018-3754

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions query-mysql versions 0.0.0 through 0.0.2 query-mysql (all versions)

Description The issue is related to a lack of user input sanitization, which may allow an attacker to run arbitrary SQL queries when fetching data from the database. This is due to an SQL injection vulnerability.

Recommendations For versions 0.0.0 through 0.0.2, consider avoiding the use of this module if user input is passed into it, as no fix is currently available for this vulnerability. For all versions, it is recommended to not install or use this module if user input is passed into it, due to the lack of a fix for the SQL injection vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2018-3754

GHSA-9MR8-6PRP-GWJV

Produtos afetados

Query-Mysql

Referências · 6

• 🔥 https://hackerone.com/reports/311244 · Exploit
• https://github.com/advisories/GHSA-9mr8-6prp-gwjv · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-3754 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-9mr8-6prp-gwjv · Aviso do Fabricante
• https://npmjs.com/advisories/666 · Nota
• https://osv.dev/vulnerability/CVE-2018-3754 · Aviso do Fabricante