GHSA-m9jw-237r-gvfv

Source

https://github.com/advisories/GHSA-m9jw-237r-gvfv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/10/GHSA-m9jw-237r-gvfv/GHSA-m9jw-237r-gvfv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-m9jw-237r-gvfv

Aliases

CVE-2019-10752

Published

2019-10-25T19:43:16Z

Modified

2024-11-13T01:11:52.332934Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

SQL Injection in sequelize

Details

Affected versions of sequelize are vulnerable to SQL Injection. The function sequelize.json() incorrectly formatted sub paths for JSON queries, which allows attackers to inject SQL statements and execute arbitrary SQL queries if user input is passed to the query. Exploitation example:

return User.findAll({
  where: this.sequelize.json("data.id')) AS DECIMAL) = 1 DELETE YOLO INJECTIONS; -- ", 1)
});

Recommendation

If you are using sequelize 5.x, upgrade to version 5.15.1 or later. If you are using sequelize 4.x, upgrade to version 4.44.3 or later.

Database specific

{
    "nvd_published_at": null,
    "github_reviewed_at": "2019-10-22T15:53:58Z",
    "github_reviewed": true,
    "severity": "CRITICAL",
    "cwe_ids": [
        "CWE-89"
    ]
}

References

Affected packages

npm / sequelize

Package

Name: sequelize; View open source insights on deps.dev
Purl: pkg:npm/sequelize

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.44.3