CVE-2020-21176 Vulnerability in npm package thinkjs

Description

SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter.

Remediation

References

https://github.com/thinkjs/thinkjs

https://blog.jiguang.xyz/posts/thinkjs-sql-injection/

Related Vulnerabilities

CVE-2017-1000387 Vulnerability in maven package org.jenkins-ci.plugins:build-publisher

CVE-2020-13942 Vulnerability in maven package org.apache.unomi:unomi-kar

CVE-2023-42399 Vulnerability in maven package org.webjars.npm:jodit

CVE-2021-22696 Vulnerability in maven package org.apache.cxf:cxf-rt-rs-security-oauth2

CVE-2016-10654 Vulnerability in npm package sfml

Severity

Critical

Classification

CWE-89 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H