CVE-2015-9244: SQL Injection
Published May 29, 2018
·Updated
Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with mysql.escape() which could lead to SQL Injection.
Affected Software
7 affected components
Mysqljs Mysql Node.js<=0.9.6
Mysqljs Mysql Node.js=2.0.0-alpha
Mysqljs Mysql Node.js=2.0.0-alpha2
Mysqljs Mysql Node.js=2.0.0-alpha3
Mysqljs Mysql Node.js=2.0.0-alpha4
Mysqljs Mysql Node.js=2.0.0-alpha7
Mysqljs Mysql Node.js=2.0.0-preview
Event History
May 29, 2018
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2015-9244?
CVE-2015-9244 is considered a critical vulnerability due to the potential for SQL Injection.
2
How do I fix CVE-2015-9244?
To fix CVE-2015-9244, upgrade to a version of the mysql node module later than 2.0.0-alpha7 that properly escapes object keys.
3
What types of applications are affected by CVE-2015-9244?
Applications using the mysql node module versions 2.0.0-alpha7 and earlier are affected by CVE-2015-9244.
4
What is the exploitation risk of CVE-2015-9244?
The exploitation risk of CVE-2015-9244 includes unauthorized access and manipulation of the database, potentially leading to data breaches.
5
Is CVE-2015-9244 related to specific database operations?
Yes, CVE-2015-9244 is specifically related to database operations involving unescaped object keys in SQL queries.