GitHub Advisoryadvisory · npm

GHSA-q5mq-6fjg-4mw8 SQL Injection in thinkjs

HIGH Published 2021-11-19 Modified 2021-11-19 Official page ↗
Aliases
CVE-2020-21176
Ecosystem
npm
Packages
thinkjs
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2021-10-07

Affected packages

• npm thinkjs: <= 3.2.14 (no fix yet)

Description

SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter.

Related

Alias · CVE (1)

  • CVE-2020-21176 SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References