CVE-2021-43608

Doctrine DBAL 3.x before 3.1.4 is affected by a SQL injection in the LIMIT clause generation. The root cause is that offset and length inputs used to build LIMIT are not reliably cast to integers, which allows injection when unescaped user input is passed to the DBAL QueryBuilder or APIs that cal...

CVE-2021-43608

Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other A...

SQL Injection

doctrine/dbal is vulnerable to SQL injection. The modifyLimitQuery function in src/Platforms/AbstractPlatform.php does not properly sanitize the input, which allows a remote attacker to inject arbitrary SQL commands to the APIs...