GHSA-45hc-r4fj-qj89

Source

https://github.com/advisories/GHSA-45hc-r4fj-qj89

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-45hc-r4fj-qj89/GHSA-45hc-r4fj-qj89.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-45hc-r4fj-qj89

Aliases

CVE-2021-44135

Published

2022-04-02T00:00:15Z

Modified

2024-02-20T05:24:28.362977Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

SQL injection in pagekit/pagekit

Details

Pagekit is a modular and lightweight CMS built with Symfony components and Vue.js. The configAction in SettingsController allow user to set the order of comments listing. The allowed options are ASC and DESC. That config then get concatenated directly to the SQL query. Due to the fact that there wasnt any sanitizion before saving that config, it can lead to the SQL Injection vulnerability.

Database specific

{
    "nvd_published_at": "2022-04-01T14:15:00Z",
    "cwe_ids": [
        "CWE-89"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2022-04-05T17:52:07Z"
}

References

Affected packages

Packagist / pagekit/pagekit

Package

Name: pagekit/pagekit
Purl: pkg:composer/pagekit/pagekit

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.0.18

Affected versions

0.*

0.8.8

0.9.0

0.9.1

0.9.2

0.9.3

0.9.4

0.9.5

0.10.0

0.10.1

0.10.2

0.10.3

0.10.4

0.11.0

0.11.1

0.11.2

0.11.3

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.8

1.0.9

1.0.10

1.0.11

1.0.12

1.0.13

1.0.14

1.0.15

1.0.16

1.0.17

1.0.18