High CVE-2015-1369 EUVD-2017-0332GHSA-xqg8-cv3h-xppv

SQL Injection in sequelize

Published Jan 27, 2015 · Updated Aug 6, 2024 · Assigned by redhat

Description

SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
npm	sequelize	< 2.0.0-rc8	2.0.0-rc8	GHSA-xqg8-cv3h-xppv

References

https://github.com/sequelize/sequelize/pull/2919
https://nodesecurity.io/advisories/sequelize-sql-injection-order
[oss-security] 20150122 CVE requests for nodejs marked VBScript Content Injection and sequelize SQL Injection in Order mailing-list