PT-2024-40009 · Silverstripe · Silverstripe/Postgresql+1

Published 2024-05-28 · Updated 2024-05-28

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions silverstripe/framework (affected versions not specified)

Description A potential SQL injection issue was identified when using the silverstripe/postgresql database adapter. Although it is unlikely to be exploitable, the issue has been patched to ensure table names are safely escaped before being passed to database adapters or user code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

GHSA-265Q-222X-52M6

Affected Products

Silverstripe/Framework

Silverstripe/Postgresql

References · 6

• https://osv.dev/vulnerability/GHSA-265q-222x-52m6 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-020-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/commit/fecedc2d98eeaaff6424fb59dc70ef6bdc6dc92d · Note
• https://github.com/silverstripe/silverstripe-framework/commit/48bd335648188df9dae72be1e5f9c808f3fe1e77 · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/download/security-releases/ss-2018-020 · Note