CVE-2019-10766 SQL Injection in usmanhalalit/pixie
SQL injection in Pixie Query Builder allows attackers to manipulate database queries via the limit function, risking data exposure or modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10766?
CVE-2019-10766 is a critical SQL injection vulnerability in Pixie Query Builder, published on 19 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization.
Weakness: CWE-89
Which versions are affected by CVE-2019-10766?
4 open source packages ship an affected version, including usmanhalalit/pixie. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
usmanhalalit/pixie Packagist | All versions | 1.0.3 |
usmanhalalit/pixie Packagist | All versions | 1.0.3 |
usmanhalalit/pixie Packagist | From 2.0.0 | 2.0.2 |
usmanhalalit/pixie Packagist | From 2.0.0 | 2.0.2 |
Products include Pixie Project Pixie.
How do I fix CVE-2019-10766?
Upgrade usmanhalalit/pixie to a fixed version for your release line: 1.0.3 or 2.0.2.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2019-10766 being exploited?
There is no known exploitation of CVE-2019-10766 in the wild and no public exploit code.
Sources
Also known as GHSA-68wg-qv6r-j4vp, SNYK-PHP-USMANHALALITPIXIE-534879.