PT-2023-10134 · Unknown · Elgs Gosqljson

Published 2023-01-07 · Updated 2023-02-22 · CVE-2014-125064

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions elgs gosqljson (affected versions not specified)

Description A critical issue has been found in elgs gosqljson, affecting the functions QueryDbToArray/QueryDbToMap/ExecDb of the file gosqljson.go. The manipulation of the argument sqlStatement leads to sql injection.

Recommendations To fix this issue, it is recommended to apply a patch. The name of the patch is 2740b331546cb88eb61771df4c07d389e9f0363a. As a temporary workaround, consider restricting the manipulation of the sqlStatement argument to minimize the risk of sql injection.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2014-125064

GHSA-G7MW-9PF9-P2PM

GO-2023-1494

Affected Products

Elgs Gosqljson

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2014-125064 · Security Note
• https://osv.dev/vulnerability/GO-2023-1494 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g7mw-9pf9-p2pm · Vendor Advisory
• https://github.com/elgs/gosqljson/commit/2740b331546cb88eb61771df4c07d389e9f0363a · Note
• https://github.com/elgs/gosqljson · Note
• https://vuldb.com/?id.217631 · Note
• https://t.me/cvenotify/41507 · Telegram Post
• https://vuldb.com/?ctiid.217631 · Note
• https://t.me/cibsecurity/56117 · Telegram Post
• https://pkg.go.dev/vuln/GO-2023-1494 · Note