PT-2018-4729

CVE-2016-10551

Published

2018-05-29

Updated

2019-10-09

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions waterline-sequel versions 0.50

Description The issue allows malicious users to input their own SQL statements, which can be executed and provide full access to the database. This occurs when user input is passed into the like, contains, startsWith, or endsWith methods in waterline-sequel.

Recommendations Upgrade to at least version 0.5.1

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers

CVE-2016-10551