~ / search / GHSA-q5mq-6fjg-4mw8

GHSA-q5mq-6fjg-4mw8

SQL Injection in thinkjs

Source: GitHub Advisory Database (reviewed) High CVE-2020-21176

Packages

EcosystemPackageAffectedFixed in
npm thinkjs <= 3.2.14 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter.

References

External links from the advisory. They lead to third-party sites.