PT-2018-4729

CVE-2016-10551

Publicado

2018-05-29

Atualizado

2019-10-09

Descrição por

CVSS 3.1

9.8

Crítica

MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions waterline-sequel versions 0.50

Description The issue allows malicious users to input their own SQL statements, which can be executed and provide full access to the database. This occurs when user input is passed into the like, contains, startsWith, or endsWith methods in waterline-sequel.

Recommendations Upgrade to at least version 0.5.1

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Identificadores relacionados

CVE-2016-10551