CVE-2016-10551 SQL Injection in waterline-sequel
CriticalCVSS 9.8
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline's like, contains, startsWith, or endsWith will end up in waterline-sequel with the potential for malicious code. A malicious user can input their own SQL statements in waterline-sequel 0.50 that will get executed and have full access to the database.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm waterline-sequel(npm) | < 0.5.1 | 0.5.1 |
| balderdash waterline-sequel | = 0.5.0 | No fix listed |
| HackerOne waterline-sequel node module | = 0.5.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com exploit issue-tracking third-party-advisory
- github.com patch
- github.com
- www.npmjs.com
- nodesecurity.io third-party-advisory