GitHub Advisoryadvisory · Packagist

GHSA-q9p4-qfc8-fvpp SQL Injection in medoo

CRITICAL Published 2021-10-12 Modified 2021-10-08 Official page ↗

Aliases: CVE-2019-10762
Ecosystem: Packagist
Packages: catfan/medoo
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-89
Reviewed: 2021-10-08

Affected packages

• Packagist catfan/medoo: < 1.7.5 → fixed in 1.7.5

Description

columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.

Related

Alias · CVE (1)

CVE-2019-10762 columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping. vulnerability

Weakness · CWE (1)

CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References