PT-2018-4734 · Sequelize · Sequelize
Leibale
·
Publicado
2018-05-29
·
Atualizado
2019-10-09
·
CVE-2016-10556
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
sequelize versions 3.19.3 and earlier
Description
The issue is related to how arrays are treated as strings and improperly escaped in Postgres, SQLite, and Microsoft SQL Server, leading to potential SQL injection. A malicious user could exploit this by inputting a specially crafted array, such as
["test", "'); DELETE TestTable WHERE Id = 1 --')"], into a query like database.query('SELECT * FROM TestTable WHERE Name IN (:names)', { replacements: { names: directCopyOfUserInput } });. This could result in the SQL statement becoming SELECT Id FROM Table WHERE Name IN ('test', ''); DELETE TestTable WHERE Id = 1 --'), which, due to the backslash having no special meaning in the mentioned databases, could lead to the deletion of a record in the TestTable with an Id of 1.Recommendations
Update to version 3.20.0 or later. As a temporary workaround, consider validating and sanitizing user input to prevent malicious data from being injected into SQL queries. Restrict access to sensitive database operations to minimize the risk of exploitation.
Exploit
Correção
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Sequelize