PT-2018-16175 · Unknown · Query-Mysql

Bl4De + 1 · Published 2018-07-03 · Updated 2018-09-10 · CVE-2018-3754

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions query-mysql versions 0.0.0 through 0.0.2 query-mysql (all versions)

Description The issue is related to a lack of user input sanitization, which may allow an attacker to run arbitrary SQL queries when fetching data from the database. This is due to an SQL injection vulnerability.

Recommendations For versions 0.0.0 through 0.0.2, consider avoiding the use of this module if user input is passed into it, as no fix is currently available for this vulnerability. For all versions, it is recommended to not install or use this module if user input is passed into it, due to the lack of a fix for the SQL injection vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2018-3754

GHSA-9MR8-6PRP-GWJV

Affected Products

Query-Mysql

References · 6

• 🔥 https://hackerone.com/reports/311244 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3754 · Security Note
• https://osv.dev/vulnerability/GHSA-9mr8-6prp-gwjv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-3754 · Vendor Advisory
• https://github.com/advisories/GHSA-9mr8-6prp-gwjv · Note
• https://npmjs.com/advisories/666 · Note