CVE-2016-15020
liftkit database Query.php processOrderBy sql injection
Also known as GHSA-8hcf-2m4v-f2rq
Published 3 y ago · modified 4 mo ago · JSON
Summary
A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/Query.php. The manipulation leads to sql injection. Upgrading to version 2.13.2 is able to address this issue. The patch is named 42ec8f2b22e0b0b98fb5b4444ed451c1b21d125a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218391.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction (EPSS)
0.70% probability of exploitation in the next 30 days, higher than 53% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 5.5 | CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 5.2 | AV:A/AC:L/Au:S/C:P/I:P/A:P |
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 2.0 | 5.2 | AV:A/AC:L/Au:S/C:P/I:P/A:P |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| packagist | liftkit/database | <2.13.2 | 2.13.2 |
Affected products
- liftkit database
Classification
- Weakness
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
- vuldb.com /?id.218391 · vdb-entry, technical-description, x_transferred
- vuldb.com /?ctiid.218391 · signature, permissions-required, x_transferred
- github.com /liftkit/database/commit/42ec8f2b22e0b0b98fb5b4444ed451c1b21d125a · patch, x_transferred
- github.com /liftkit/database/releases/tag/v2.13.2 · patch, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-15020 · advisory
- github.com /liftkit/database · package
Sources
- CVE List: CVE-2016-15020
- GitHub Advisory: GHSA-8hcf-2m4v-f2rq
- NVD: CVE-2016-15020
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.