CVE-2024-39677: NHibernate SQL injection vulnerability in discriminator mappings, static fields referenced in HQL, and some utilities

A SQL injection vulnerability exists in some types implementing ILiteralType.ObjectToSQLString. Callers of these methods are exposed to the vulnerability, which includes:

• Mappings using inheritance with discriminator values:
• The discriminator value could be written in the mapping in a way exploiting the vulnerability of the associated discriminator type, if that type is among the vulnerable ones.
• The current culture settings for formatting the discriminator value type could be altered in a way resulting into SQL injections with the discriminator values.
• HQL queries referencing a static field of the application.
• Users of the SqlInsertBuilder and SqlUpdateBuilder utilities, calling their AddColumn overload taking a literal value. These overloads are unused by NHibernate but could be used by users referencing directly these utilities.
• Any direct use of the ObjectToSQLString methods for building SQL queries on the user side.