PT-2023-10134 · Unknown · Elgs Gosqljson

CVE-2014-125064

·

Publicado

2023-01-07

·

Atualizado

2023-02-22

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions elgs gosqljson (affected versions not specified)
Description A critical issue has been found in elgs gosqljson, affecting the functions QueryDbToArray/QueryDbToMap/ExecDb of the file gosqljson.go. The manipulation of the argument sqlStatement leads to sql injection.
Recommendations To fix this issue, it is recommended to apply a patch. The name of the patch is 2740b331546cb88eb61771df4c07d389e9f0363a. As a temporary workaround, consider restricting the manipulation of the sqlStatement argument to minimize the risk of sql injection.

Correção

SQL injection

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2014-125064
GHSA-G7MW-9PF9-P2PM
GO-2023-1494

Produtos afetados

Elgs Gosqljson