PT-2023-11815 · Unknown · Square Squalor

Published 2023-01-07 · Updated 2026-02-18 · CVE-2020-36645

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions square squalor versions prior to v0.0.0

Description A critical issue was found in square squalor, affecting an unknown part, leading to sql injection. The manipulation with the table name parameter is potentially vulnerable to SQL injection.

Recommendations For versions prior to v0.0.0, upgrade to version v0.0.0 to address this issue. As a temporary workaround, consider restricting the use of the table name parameter to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-36645

GHSA-3HC7-2XCC-7P8F

GO-2023-1295

Affected Products

Square Squalor

References · 15

• https://github.com/square/squalor/releases/tag/v0.0.0 · Patch
• https://github.com/square/squalor/pull/76 · Patch
• https://github.com/square/squalor/commit/f6f0a47cc344711042eb0970cb423e6950ba3f93 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-36645 · Security Note
• https://osv.dev/vulnerability/GHSA-3hc7-2xcc-7p8f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36645 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1295 · Vendor Advisory
• https://github.com/square/squalor · Note
• https://github.com/square/squalor/pull/76/commits/033350b8596b397c6cefa066b1f2c83d35fc8c4a · Note
• https://t.me/cvenotify/41499 · Telegram Post
• https://t.me/cveNotify/152316 · Telegram Post
• https://vuldb.com/?id.217623 · Note
• https://vuldb.com/?ctiid.217623 · Note
• https://t.me/cibsecurity/56119 · Telegram Post
• https://t.me/cveNotify/147886 · Telegram Post