SQL Injection

2023-01-1201:54:35

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

sql injection

nodebatis

vulnerability

sqlbuilder.js

key

tablename

malicious queries

software

0.002 Low

EPSS

Percentile

51.9%

JSON

nodebatis is vulnerable to sql injection. The vulnerability exists due to the getInsertSql function in sqlBuilder.js which doesn’t escape the key and tableName attributes, allowing an attacker to inject and execute malicious SQL queries.

CPENameOperatorVersion
nodebatisle2.1.3
nodebatisle2.1.3

CPE	Name	Operator	Version
	nodebatis	le	2.1.3
	nodebatis	le	2.1.3

References

github.com/advisories/GHSA-8ph8-9q2j-c3rq

github.com/PeterMu/nodebatis/commit/6629ff5b7e3d62ad8319007a54589ec1f62c7c35

github.com/PeterMu/nodebatis/releases/tag/v2.2.0

vuldb.com/?ctiid.217554

vuldb.com/?id.217554

0.002 Low

EPSS

Percentile

51.9%

JSON

Related for VERACODE:38839