GHSA-f626-677r-j5vq
Withdrawn Advisory: Nette Database SQL injection
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | nette/database | <= 3.2.4 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
## Withdrawn Advisory
This advisory has been withdrawn as it was reported in error. This link is maintained to preserve external references.
## Original Description
Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2024-55586
- https://github.com/github/advisory-database/pull/5079#issuecomment-2552932977
- https://github.com/CSIRTTrizna/CVE-2024-55586
- https://github.com/nette/database
- https://github.com/nette/database/releases
- https://www.csirt.sk/nette-framework-vulnerability-permits-sql-injection.html