CVE-2015-1369 SQL Injection in sequelize
HighCVSS 7.5
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm sequelize(npm) | <= 2.0.0-rc7 | No fix listed |
| sequelize project sequelize | <= 2.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com
- github.com
- www.npmjs.com
- github.com exploit patch
- [oss-security] 20150122 CVE requests for nodejs marked VBScript Content Injection and sequelize SQL Injection in Order mailing-list
- nodesecurity.io exploit