GitHub Advisoryadvisory · PyPI

GHSA-pq9p-pc3p-9hm4 python-sql SQL injection vulnerability

MEDIUM Published 2024-12-27 Modified 2025-02-07 Official page ↗
Aliases
CVE-2024-9774
Ecosystem
PyPI
Packages
python-sql
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-150
Reviewed
2024-12-27

Affected packages

• PyPI python-sql: < 1.5.2 → fixed in 1.5.2

Description

A vulnerability was found in python-sql where unary operators do not escape non-Expression (like `And` and `Or`) which makes any system exposing those vulnerable to an SQL injection attack.

Related

Alias · CVE (1)

  • CVE-2024-9774 A vulnerability was found in python-sql where unary operators do not escape non-Expression. vulnerability

Weakness · CWE (1)

  • CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences weakness

References