PT-2018-4734 · Sequelize · Sequelize
Leibale
·
Published
2018-05-29
·
Updated
2019-10-09
·
CVE-2016-10556
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
sequelize versions 3.19.3 and earlier
Description
The issue is related to how arrays are treated as strings and improperly escaped in Postgres, SQLite, and Microsoft SQL Server, leading to potential SQL injection. A malicious user could exploit this by inputting a specially crafted array, such as
["test", "'); DELETE TestTable WHERE Id = 1 --')"], into a query like database.query('SELECT * FROM TestTable WHERE Name IN (:names)', { replacements: { names: directCopyOfUserInput } });. This could result in the SQL statement becoming SELECT Id FROM Table WHERE Name IN ('test', ''); DELETE TestTable WHERE Id = 1 --'), which, due to the backslash having no special meaning in the mentioned databases, could lead to the deletion of a record in the TestTable with an Id of 1.Recommendations
Update to version 3.20.0 or later. As a temporary workaround, consider validating and sanitizing user input to prevent malicious data from being injected into SQL queries. Restrict access to sensitive database operations to minimize the risk of exploitation.
Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sequelize