PT-2018-4729 · Sailjs · Waterline-Sequel

Jamsea · Published 2018-05-29 · Updated 2019-10-09 · CVE-2016-10551

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions waterline-sequel versions 0.50

Description The issue allows malicious users to input their own SQL statements, which can be executed and provide full access to the database. This occurs when user input is passed into the like, contains, startsWith, or endsWith methods in waterline-sequel.

Recommendations Upgrade to at least version 0.5.1

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2016-10551

GHSA-CGPP-WM2H-6HQX

Affected Products

Waterline-Sequel

References · 8

• 🔥 https://github.com/balderdashy/waterline/issues/1219#issuecomment-157294530 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-10551 · Security Note
• https://osv.dev/vulnerability/GHSA-cgpp-wm2h-6hqx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-10551 · Vendor Advisory
• https://github.com/balderdashy/waterline-sequel/pull/66 · Note
• https://github.com/advisories/GHSA-cgpp-wm2h-6hqx · Note
• https://nodesecurity.io/advisories/115 · Note
• https://npmjs.com/advisories/115 · Note