SQL Injection

propel/propel1 is vulnerable to SQL Injection. The vulnerability is due to a lack of implicit integer cast of the limit input, which allows an attacker to execute malicious SQL...

GHSA-7G7C-QHF3-X59P propel/propel1 SQL injection possible with limit() on MySQL

The limit query method is susceptible to catastrophic SQL injection with MySQL. For example, given a model User for a table users: UserQuery::create-limit'1;DROP TABLE users'-find; This will drop the users table! The cause appears to be a lack of integer casting of the limit input in either...

propel/propel1 SQL injection possible with limit() on MySQL

The limit query method is susceptible to catastrophic SQL injection with MySQL. For example, given a model User for a table users: UserQuery::create-limit'1;DROP TABLE users'-find; This will drop the users table! The cause appears to be a lack of integer casting of the limit input in either...