CVE-2014-8682: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

June 29, 2021

Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.

References

github.com/advisories/GHSA-g6xv-8q23-w2q3
github.com/gogits/gogs/commit/0c5ba4573aecc9eaed669e9431a70a5d9f184b8d
github.com/gogits/gogs/releases/tag/v0.5.8
nvd.nist.gov/vuln/detail/CVE-2014-8682

Code Behaviors & Features

Detect and mitigate CVE-2014-8682 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →