GitHub Advisoryadvisory · Maven

GHSA-w559-623p-vfg8 MyBatis PageHelper vulnerable to time-blind SQL injection via orderBy parameter

CRITICAL Published 2022-05-05 Modified 2022-10-20 Official page ↗
Aliases
CVE-2022-28111
Ecosystem
Maven
Packages
com.github.pagehelper:pagehelper
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2022-10-20

Affected packages

• Maven com.github.pagehelper:pagehelper: >= 3.5.0, < 5.3.1 → fixed in 5.3.1

Description

MyBatis PageHelper versions 3.5.x through 5.3.x were discovered to contain a time-blind SQL injection vulnerability via the orderBy parameter.

Related

Alias · CVE (1)

  • CVE-2022-28111 MyBatis PageHelper v1.x.x-v3.7.0 v4.0.0-v5.0.0,v5.1.0-v5.3.0 was discovered to contain a time-blind SQL injection vulnerability via the… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References