What is GHSA-9mr8-6prp-gwjv?

GHSA-9mr8-6prp-gwjv is a security advisory published by GitHub Security Advisories with High severity. SQL Injection in query-mysql

Which CVE IDs does GHSA-9mr8-6prp-gwjv cover?

GHSA-9mr8-6prp-gwjv covers the following CVE IDs: CVE-2018-3754. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9mr8-6prp-gwjv?

GHSA-9mr8-6prp-gwjv has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-9mr8-6prp-gwjv?

GHSA-9mr8-6prp-gwjv affects 1 product, including: npm/query-mysql:\u003c= 0.0.2.

GHSA-9mr8-6prp-gwjvHighCVSS 8.8

SQL Injection in query-mysql

Vendor

GitHub Security Advisories

Published

September 10, 2018

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2018-3754 →

📋 Description

All versions of query-mysql are vulnerable to SQL injection due to lack of user input sanitization allows to run arbitrary SQL queries when fetching data from database.

Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module if user input is passed into this module.

🎯 Affected products1

npm/query-mysql:<= 0.0.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2018-3754
https://hackerone.com/reports/311244
https://github.com/advisories/GHSA-9mr8-6prp-gwjv
https://www.npmjs.com/advisories/666