GHSA-g7mw-9pf9-p2pm

Source

https://github.com/advisories/GHSA-g7mw-9pf9-p2pm

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-g7mw-9pf9-p2pm/GHSA-g7mw-9pf9-p2pm.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-g7mw-9pf9-p2pm

Aliases

CVE-2014-125064
GO-2023-1494

Published

2023-01-07T21:30:39Z

Modified

2023-11-01T04:45:30.027214Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

gosqljson SQL Injection vulnerability

Details

A vulnerability, which was classified as critical, has been found in elgs gosqljson. This issue affects the function QueryDbToArray/QueryDbToMap/ExecDb of the file gosqljson.go. The manipulation of the argument sqlStatement leads to sql injection. The name of the patch is 2740b331546cb88eb61771df4c07d389e9f0363a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217631.

Database specific

{
    "cwe_ids": [
        "CWE-89"
    ],
    "nvd_published_at": "2023-01-07T20:15:00Z",
    "github_reviewed": true,
    "severity": "CRITICAL",
    "github_reviewed_at": "2023-01-12T23:40:45Z"
}

References

Affected packages

Go / github.com/elgs/gosqljson

Package

Name: github.com/elgs/gosqljson; View open source insights on deps.dev
Purl: pkg:golang/github.com/elgs/gosqljson

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.0.0-20220916234230-750f26ee23c7