PT-2023-20322 · Sequelize · Sequelize
Ephys
·
Published
2023-02-22
·
Updated
2023-03-03
·
CVE-2023-25813
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Sequelize versions prior to 6.19.1
Description
The issue is related to SQL injection due to improper escaping of parameters passed through replacements. This can lead to arbitrary SQL injection depending on the specific queries in use. For example, in a query where some parameters are passed through replacements and some are passed directly through the
where option, an attacker could inject malicious SQL code by providing specially crafted input, such as OR true; DROP TABLE users;. The estimated number of potentially affected devices worldwide is not available.Recommendations
For Sequelize versions prior to 6.19.1, upgrade to version 6.19.1 or later to fix the issue.
As a temporary workaround for users unable to upgrade, do not use the
replacements and the where option in the same query.Exploit
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sequelize