CVE-2021-43608: SQL Injection
Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input to the DBAL QueryBuilder or any other API that ultimately uses the AbstractPlatform::modifyLimitQuery API.
Other sources
SQL Injection in Limit Clause Generation API
We have released a new version Doctrine DBAL 3.1.4 that fixes a critical SQL injection vulnerability in the LIMIT clause generation API provided by the Platform abstraction.
We advise everyone using Doctrine DBAL 3.0.0 up to 3.1.3 to upgrade to 3.1.4 immediately.
The vulnerability can happen when unsanitized input is passed to many APIs in Doctrine DBAL and ORM that ultimately end up calling AbstractPlatform::modifyLimitQuery.
As a workaround you can cast all limit and offset parameters to integers before passing them to Doctrine APIs.
This vulnerability has been assigned CVE-2021-43608.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-43608?
CVE-2021-43608 has a high severity due to the potential for SQL Injection, which can lead to unauthorized access to the database.
How do I fix CVE-2021-43608?
To fix CVE-2021-43608, upgrade the Doctrine DBAL to version 3.1.4 or later.
What versions of Doctrine DBAL are affected by CVE-2021-43608?
CVE-2021-43608 affects Doctrine DBAL versions from 3.0.0 up to, but not including, 3.1.4.
What type of vulnerability is CVE-2021-43608?
CVE-2021-43608 is classified as an SQL Injection vulnerability.
How can CVE-2021-43608 be exploited?
CVE-2021-43608 can be exploited when unescaped user input is passed to the DBAL QueryBuilder, allowing attackers to manipulate SQL queries.