Potential SQL Injection

Overview Affected versions of sequelize are vulnerable to SQL Injection when user input is passed into findOne or into a statement such as where: "user input". Recommendation Update to version 3.0.0 or later. Version 3.0.0 will introduce a number of breaking changes. Thankfully, the project autho...

SQL Injection

Overview Affected versions of sequelize cast arrays to strings and fail to properly escape the resulting SQL statement, resulting in a SQL injection vulnerability. Proof of Concept In Postgres, SQLite, and Microsoft SQL Server there is an issue where arrays are treated as strings and improperly...

SQL Injection

Overview Versions 2.0.0-rc-7 and earlier of sequelize are affected by a SQL injection vulnerability when user input is passed into the order parameter. Proof of Concept javascript Test.findAndCountAll where: id :1 , order : 'id', 'UNTRUSTED USER INPUT' Recommendation Update to version 2.0.0-rc8 o...

Joyent Node.js Sequelize SQL Injection Vulnerability

Joyent Node.js is the United States Joyent company's set of web applications built on Google V8 JavaScript engine on top of the platform. Sequelize is one of the database ORM object-relational mapping tool. A SQL injection vulnerability exists in Joyent Node.js Sequelize. A remote attacker can...

CVE-2015-1369

SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter...

Sql injection

SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter...

CVE-2015-1369

SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter...

@weiqiwang/nodejs-develop-kit (1.2.0), alke (>=0.0.1, <=0.0.2) +76 more potentially affected by CVE-2015-1369 via sequelize (>=1.0.2, <=2.0.0-rc4)

sequelize NPM version =1.0.2, =0.0.1, =0.0.1, =0.1.0, =0.0.1-alpha1, =0.0.2, =0.0.1, =0.0.7, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2015-1369 Source advisory: MEND:CVE-2015-1369...

CVE-2015-1369

SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter...

CVE-2015-1369

Summary: CVE-2015-1369 is a SQL injection in Sequelize for Node.js, affecting versions up to and including 2.0.0-rc7 where user input placed in the order parameter can lead to arbitrary SQL execution. The issue is caused by unsafe handling of the order input, enabling attackers to influence queri...

PT-2015-5244

Name of the Vulnerable Software and Affected Versions sequelize versions prior to 2.0.0-rc8 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the order parameter when user input is passed into it. This can be exploited by manipulating the order...

CVE-2015-1369: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter...