Users can provoke SQL injections if they can specify a node name or query.
Upgrade to version 1.7.4
If that is not possible, you can escape all places where $property
is used to filter sv:name
in the class Jackalope\Transport\DoctrineDBAL\Query\QOMWalker
: XPath::escape($property)
.
Node names and xpaths can contain "
or ;
according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection.
If queries are never done from user input, or if you validate the user input to not contain ;
, you are not affected.
No further references.
If you have any questions or comments about this advisory:
{ "nvd_published_at": "2021-12-13T20:15:00Z", "github_reviewed_at": "2021-12-14T15:25:41Z", "severity": "HIGH", "github_reviewed": true, "cwe_ids": [ "CWE-89" ] }