CVE-2021-4262 laravel-jqgrid EloquentRepositoryAbstract.php getRows sql injection
Attackers can execute arbitrary SQL commands via the getRows function in the laravel-jqgrid library, potentially accessing or modifying database contents.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-4262?
CVE-2021-4262 is a medium-severity SQL injection vulnerability in unspecified laravel-jqgrid, published on 19 Dec 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability classified as critical was found in laravel-jqgrid. Affected by this vulnerability is the function getRows of the file src/Mgallegos/LaravelJqgrid/Repositories/EloquentRepositoryAbstract.php. The manipulation leads to sql injection. The name of the patch is fbc2d94f43d0dc772767a5bdb2681133036f935e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216271.
Which versions are affected by CVE-2021-4262?
2 open source packages ship an affected version, including mgallegos/laravel-jqgrid. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mgallegos/laravel-jqgrid Packagist | All versions to 1.3.0 | None |
mgallegos/laravel-jqgrid Packagist | All versions to 1.3.0 | None |
Products include Laravel Jqgrid Project Laravel Jqgrid.
How do I fix CVE-2021-4262?
No fix has been published for CVE-2021-4262 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2021-4262 being exploited?
There is no known exploitation of CVE-2021-4262 in the wild and no public exploit code.
Sources
Also known as GHSA-3fhj-wpvj-x5w8.