PT-2024-40161 · Propel · Propel

Published 2024-05-20 · Updated 2024-05-20

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Propel versions 1.x through 3.x

Description: The issue arises from the limit() query method being susceptible to catastrophic SQL injection when using MySQL. This occurs due to a lack of integer casting of the limit input in either Criteria::setLimit() or in DBMySQL::applyLimit(). The code comments suggest that casting was avoided to prevent overflow issues with 32-bit integers. This behavior is unexpected since one of the primary purposes of an Object-Relational Mapping (ORM) system is to prevent basic SQL injection.

Recommendations: For all affected versions, consider disabling the limit() query method until a proper fix is implemented to prevent SQL injection. Restrict access to the Criteria::setLimit() and DBMySQL::applyLimit() functions to minimize the risk of exploitation. Avoid using the limit() query method in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

GHSA-7G7C-QHF3-X59P

Affected Products

Propel

References · 6

• https://osv.dev/vulnerability/GHSA-7g7c-qhf3-x59p · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/propel/propel1/2018-02-14.yaml · Note
• https://github.com/propelorm/Propel/issues/1052 · Note
• https://github.com/propelorm/Propel/commit/b72093201f8e225410f62a246653ac039e31c90a · Note
• https://github.com/propelorm/Propel/pull/1054 · Note
• https://github.com/propelorm/Propel · Note