CVE-2016-10551: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

February 18, 2019 (updated January 8, 2021)

waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline’s like, contains, startsWith, or endsWith will end up in waterline-sequel with the potential for malicious code. A malicious user can input their own SQL statements in waterline-sequel 0.50 that will get executed and have full access to the database.

References

github.com/advisories/GHSA-cgpp-wm2h-6hqx
github.com/balderdashy/waterline-sequel/pull/66
github.com/balderdashy/waterline/issues/1219
nodesecurity.io/advisories/115
nvd.nist.gov/vuln/detail/CVE-2016-10551
www.npmjs.com/advisories/115

Code Behaviors & Features

Detect and mitigate CVE-2016-10551 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →