CVE-2020-36645 square squalor sql injection
Attackers can execute arbitrary SQL commands via the square squalor Go library, potentially reading or modifying database contents.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-36645?
CVE-2020-36645 is a medium-severity SQL injection vulnerability in square squalor, published on 7 Jan 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability, which was classified as critical, was found in square squalor. This affects an unknown part. The manipulation leads to sql injection. Upgrading to version v0.0.0 is able to address this issue. The patch is named f6f0a47cc344711042eb0970cb423e6950ba3f93. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217623.
Weakness: CWE-89
Which versions are affected by CVE-2020-36645?
3 open source packages ship an affected version, including github.com/square/squalor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/square/squalor Go | All versions | 0.0.0-20200306154055-f6f0a47cc344 |
github.com/square/squalor Go | All versions | 0.0.0-20200306154055-f6f0a47cc344 |
github.com/square/squalor Go | All versions | 0.0.0-20200306154055-f6f0a47cc344 |
Products include Squareup Squalor.
How do I fix CVE-2020-36645?
Upgrade github.com/square/squalor to 0.0.0-20200306154055-f6f0a47cc344 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2020-36645 being exploited?
There is no known exploitation of CVE-2020-36645 in the wild and no public exploit code.
Sources
Also known as GHSA-3hc7-2xcc-7p8f, GO-2023-1295.