CVE-2018-7269: SQL Injection
Potential SQL injection in methods yii\db\ActiveRecord::findOne() and ::findAll()
Other sources
The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attacks via a findOne() or findAll() call, unless a developer recognizes an undocumented need to sanitize array input.
— GitHub
The findByCondition function in framework/db/ActiveRecord.php in Yii 2.x before 2.0.15 allows remote attackers to conduct SQL injection attacks via a findOne() or findAll() call, unless a developer recognizes an undocumented need to sanitize array input.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/yiisoft/yii2-devto a version that resolves this vulnerability.Fixed in 2.0.15 - Upgrade
Upgrade
composer/yiisoft/yii2-devto a version that resolves this vulnerability.Fixed in 2.0.13.2 - Upgrade
Upgrade
composer/yiisoft/yii2-devto a version that resolves this vulnerability.Fixed in 2.0.12.1
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7269?
CVE-2018-7269 is classified as a medium severity vulnerability due to its potential for SQL injection attacks.
How do I fix CVE-2018-7269?
To fix CVE-2018-7269, upgrade to Yii version 2.0.15 or later.
What versions of Yii are affected by CVE-2018-7269?
CVE-2018-7269 affects Yii versions prior to 2.0.15, specifically 2.0.0 through 2.0.14.
Can CVE-2018-7269 be exploited remotely?
Yes, CVE-2018-7269 can be exploited remotely through specific calls to findOne() or findAll() methods.
What types of attacks can CVE-2018-7269 facilitate?
CVE-2018-7269 can facilitate SQL injection attacks, potentially leading to unauthorized database access.