Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTltcjgtNnBycC1nd2p2
SQL Injection in query-mysql
All versions of query-mysql are vulnerable to SQL injection due to lack of user input sanitization allows to run arbitrary SQL queries when fetching data from database.
Recommendation
No fix is currently available for this vulnerability. It is our recommendation to not install or use this module if user input is passed into this module.
Permalink: https://github.com/advisories/GHSA-9mr8-6prp-gwjvJSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTltcjgtNnBycC1nd2p2
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 5 years ago
Updated: over 1 year ago
CVSS Score: 8.8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-9mr8-6prp-gwjv, CVE-2018-3754
References:
- https://nvd.nist.gov/vuln/detail/CVE-2018-3754
- https://hackerone.com/reports/311244
- https://github.com/advisories/GHSA-9mr8-6prp-gwjv
- https://www.npmjs.com/advisories/666
Affected Packages
npm:query-mysql
Dependent packages: 1Dependent repositories: 1
Downloads: 48 last month
Affected Version Ranges: <= 0.0.2
No known fixed version
All affected versions: 0.0.0, 0.0.1, 0.0.2