GitHub Advisoryadvisory · Go

GHSA-rwcf-gq22-ph83 IBAX go-ibax vulnerable to SQL injection

HIGH Published 2022-11-01 Modified 2024-04-24 Official page ↗
Aliases
CVE-2022-3800
Ecosystem
Go
Packages
github.com/IBAX-io/go-ibax
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2024-04-24

Affected packages

• Go github.com/IBAX-io/go-ibax: < 1.4.2 → fixed in 1.4.2

Description

A vulnerability, which was classified as critical, has been found in IBAX go-ibax. Affected by this issue is some unknown functionality of the file /api/v2/open/rowsInfo. The manipulation of the argument table_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212636.

Related

Alias · CVE (1)

  • CVE-2022-3800 A vulnerability, which was classified as critical, has been found in IBAX go-ibax. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References