Description

Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.

Remediation

References

https://github.com/felixge/node-mysql/issues/342

https://nodesecurity.io/advisories/66

Related Vulnerabilities

CVE-2022-25918 Vulnerability in npm package shescape

CVE-2020-7723 Vulnerability in npm package promisehelpers

CVE-2021-21316 Vulnerability in npm package less-openui5

CVE-2023-7148 Vulnerability in maven package ml.shifu:shifu

CVE-2023-42795 Vulnerability in maven package org.apache.tomcat:tomcat

Severity

Critical

Classification

CWE-89 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory