CVE-2016-10550: SQL Injection
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the limit or order parameters, a malicious user can put in their own SQL statements. This affects sequelize 3.16.0 and earlier.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2016-10550?
CVE-2016-10550 is a critical vulnerability in the Sequelizejs Sequelize library, affecting versions up to and including 3.16.0.
What is the severity of CVE-2016-10550?
CVE-2016-10550 has a severity rating of critical, with a severity value of 9.8.
How does CVE-2016-10550 affect sequelize?
CVE-2016-10550 allows a malicious user to execute their own SQL statements if user input is injected into the 'limit' or 'order' parameters in sequelize.
What software is affected by CVE-2016-10550?
CVE-2016-10550 affects the Sequelizejs Sequelize library in Node.js, up to and including version 3.16.0.
Are there any references related to CVE-2016-10550?
Yes, you can find more information about CVE-2016-10550 at the following references: [1] https://github.com/sequelize/sequelize/pull/5167/commits/f282d85e60e3df5e57ecdb82adccb4eaef404f03 [2] https://nodesecurity.io/advisories/112