p PatchFirst

GHSA-7g7c-qhf3-x59p

GHSA-7g7c-qhf3-x59p · propel/propel1 SQL injection possible with limit() on MySQL

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

The limit() query method is susceptible to catastrophic SQL injection with MySQL. For example, given a model User for a table users: ``` UserQuery::create()->limit('1;DROP TABLE users')->find(); ``` This will drop the users table! The cause appears to be a lack of integer casting of the limit input in either Criteria::setLimit() or in DBMySQL::applyLimit(). The code comments there seem to imply that casting was avoided due to overflow issues with 32-bit integers. This is surprising behavior since one of the primary purposes of an ORM is to prevent basic SQL injection. This affects all versions of Propel: 1.x, 2.x, and 3.

CVSS 9.8 · Critique · Correctif disponible

Publication
Mise à jour

Pile logicielle: php

Produits et versions concernés

  • propel/propel1 Packagist

    Versions du logiciel
    • 1.6.2
    • 1.6.3
    • 1.6.4
    • 1.6.5
    • 1.6.6
    • 1.6.7
    • 1.6.8
    • 1.6.9
    • 1.7.0
    • 1.7.1
    Plages de versions concernées
    • ECOSYSTEM: ≥ 1, < 1.7.2

    Mettez à jour vers 1.7.2

Sources originales

Vérifiez votre serveur →