8.8high
CVE-2018-3754
SQL Injection in query-mysql
Also known as GHSA-9mr8-6prp-gwjv
Published 8 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.2%
percentile 68%
Public exploits
0
none known
Summary
Node.js third-party module query-mysql versions 0.0.0, 0.0.1, and 0.0.2 are vulnerable to an SQL injection vulnerability due to lack of user input sanitization. This may allow an attacker to run arbitrary SQL queries when fetching data from database.
Exploit prediction (EPSS)
1.20% probability of exploitation in the next 30 days, higher than 68% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
| GitHub | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | query-mysql | <=0.0.2 | no fix listed |
Classification
- Weakness
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
- hackerone.com /reports/311244 · x_refsource_MISC, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2018-3754 · advisory
- github.com /advisories/GHSA-9mr8-6prp-gwjv · advisory
- npmjs.com /advisories/666 · web
Sources
- CVE List: CVE-2018-3754
- GitHub Advisory: GHSA-9mr8-6prp-gwjv
- NVD: CVE-2018-3754
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.