PT-2018-4557 · Mysql Server · Mysql Server

Sebdej · Publicado 2018-05-29 · Atualizado 2021-05-18 · CVE-2015-9244

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mysql versions prior to 2.0.0-alpha8

Description The issue is related to SQL Injection due to the lack of proper escaping of object keys with mysql.escape() in the mysql node module. This could lead to SQL Injection attacks.

Recommendations Update to version 2.0.0-alpha8 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2015-9244

GHSA-FVQ6-55GV-JX9F

Produtos afetados

Mysql Server

Referências · 12

• 🔥 https://github.com/felixge/node-mysql/issues/342 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-9244 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2015-9244 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2015-9244 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2015-9244 · Aviso do Fabricante
• https://npmjs.com/advisories/66 · Nota
• https://osv.dev/vulnerability/GHSA-fvq6-55gv-jx9f · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-9244 · Aviso do Fabricante
• https://t.me/cvenotify/14611 · Publicação no Telegram
• https://nodesecurity.io/advisories/66 · Nota
• https://ubuntu.com/security/CVE-2015-9244 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-9244 · Aviso do Fabricante