SQL Injection Vulnerability in Waterline Sequel Module by Balderdashy
CVE-2016-10551

9.8CRITICAL

Key Information:

Vendor

Hackerone

Status
Waterline-sequel Node Module
Vendor
CVE Published:
29 May 2018

What is CVE-2016-10551?

The waterline-sequel module for Waterline apps is susceptible to SQL injection due to improper handling of user inputs. Specifically, any inputs processed through the module’s like, contains, startsWith, or endsWith functions can result in executable SQL code being injected. This vulnerability allows attackers to manipulate database queries, potentially gaining unauthorized access to sensitive data. It is crucial for applications using Waterline-sequel to validate and sanitize user inputs to mitigate these risks.

Affected Version(s)

waterline-sequel node module 0.5.0

References

https://github.com/balderdashy/waterline/issues/1219#issu...
x_refsource_MISC
https://nodesecurity.io/advisories/115
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2016-10551 : SQL Injection Vulnerability in Waterline Sequel Module by Balderdashy