SQL Injection Vulnerability in SQLAlchemy Framework
CVE-2019-7164

9.8CRITICAL

Key Information:

Vendor: Sqlalchemy
Status: Sqlalchemy
Vendor: CVE Published:; 20 February 2019

What is CVE-2019-7164?

SQLAlchemy, a popular SQL toolkit and Object-Relational Mapping (ORM) system for Python, contains a vulnerability that allows for SQL injection through the 'order_by' parameter. This weakness can potentially be exploited by attackers to manipulate database queries, leading to unauthorized access or data exposure. Affected versions include SQLAlchemy 1.2.17 and 1.3.x up to 1.3.0b2. It is crucial for developers using these versions to apply the latest security updates to protect their applications.