CVE-2019-5715 Silverstripe Framework SQLi Vulnerability
Attackers can execute arbitrary SQL commands via reflected injection in SilverStripe forms and data objects, potentially accessing or modifying database content.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-5715?
CVE-2019-5715 is a critical SQL injection vulnerability in Silverstripe Silverstripe, published on 11 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to 4.0.7, 4.1.5, 4.2.4, and 4.3.1 allows Reflected SQL Injection through Form and DataObject.
Weakness: CWE-89
Which versions are affected by CVE-2019-5715?
12 open source packages ship an affected version, including silverstripe/framework. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
silverstripe/framework Packagist | From 3.0.0 | 3.6.7 |
silverstripe/framework Packagist | From 3.0.0 | 3.6.7 |
silverstripe/framework Packagist | From 3.7.0 | 3.7.3 |
silverstripe/framework Packagist | From 3.7.0 | 3.7.3 |
silverstripe/framework Packagist | From 4.0.0 | 4.0.7 |
silverstripe/framework Packagist | From 4.0.0 | 4.0.7 |
6 more packages
silverstripe/framework Packagist | From 4.1.0 | 4.1.5 |
silverstripe/framework Packagist | From 4.1.0 | 4.1.5 |
silverstripe/framework Packagist | From 4.2.0 | 4.2.4 |
silverstripe/framework Packagist | From 4.2.0 | 4.2.4 |
silverstripe/framework Packagist | From 4.3.0 | 4.3.1 |
silverstripe/framework Packagist | From 4.3.0 | 4.3.1 |
Products include Silverstripe Silverstripe.
How do I fix CVE-2019-5715?
Upgrade silverstripe/framework to a fixed version for your release line: 3.6.7, 3.7.3, 4.0.7 or 4.1.5.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2019-5715 being exploited?
There is no known exploitation of CVE-2019-5715 in the wild and no public exploit code.
Other vulnerabilities in Silverstripe Silverstripe
- CVE-2007-2321 Other in n/a
- CVE-2019-12204 Missing warning can lead to unauthenticated admin access in SilverStripe
- CVE-2019-12437 Silverstripe CSRF Protection Bypass via GraphQL
- CVE-2020-6164 Silverstripe CMS information disclosure
- CVE-2020-9280 SilverStripe Folders migrated from 3.x may be unsafe to upload to
Sources
Also known as GHSA-wvfw-w3x6-g526.