GHSA-hq8g-qq57-5275 SQL Injection in untitled-model
Attackers can execute arbitrary SQL queries via unsanitized parameters in the untitled-model library, risking data exposure or modification.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is GHSA-hq8g-qq57-5275?
GHSA-hq8g-qq57-5275 is a SQL injection vulnerability in untitled-model, published on 11 Sep 2020. It can be exploited over the network, with no action from the victim.
Official description
All versions of untitled-model re vulnerable to SQL Injection. Query parameters are not properly sanitized allowing attackers to inject SQL statements and execute arbitrary SQL queries.
Recommendation
No fix is currently available. Consider using an alternative package until a fix is made available.
Which versions are affected by GHSA-hq8g-qq57-5275?
2 open source packages ship an affected version, including untitled-model.
| Package | Affected | Fixed in |
|---|---|---|
untitled-model npm | All versions | None |
untitled-model npm | All versions | None |
How do I fix GHSA-hq8g-qq57-5275?
No fix has been published for GHSA-hq8g-qq57-5275 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is GHSA-hq8g-qq57-5275 being exploited?
There is no known exploitation of GHSA-hq8g-qq57-5275 in the wild and no public exploit code.