CVE-2015-9244 SQL Injection in mysql
Attackers can execute arbitrary SQL commands via unescaped object keys in the mysql Node.js module, potentially compromising database integrity and confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-9244?
CVE-2015-9244 is a critical SQL injection vulnerability in HackerOne mysql node module, published on 29 May 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.
Weakness: CWE-89
Which versions are affected by CVE-2015-9244?
2 open source packages ship an affected version, including mysql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mysql npm | All versions | 2.0.0-alpha8 |
mysql npm | All versions | 2.0.0-alpha8 |
Products include Mysqljs Mysql.
How do I fix CVE-2015-9244?
Upgrade mysql to 2.0.0-alpha8 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2015-9244 being exploited?
There is no known exploitation of CVE-2015-9244 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2015-9244, GHSA-fvq6-55gv-jx9f.