[query-mysql] SQL Injection due to lack of user input sanitization allows to run arbitrary SQL queries when fetching data from database
该报告还没有中文解读。
原文摘录
摘自原文（5427 字符中的一小部分）
There is SQL Injection in query-mysql module. Due to lack of sanitization of user input, an attacker is able to craft SQL query and get any data from the database.
原文中的代码
This is one of those functions, which allows to select record from the table depends on value for the column:
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Node.js third-party modules 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @bl4de · 版权归作者与 Node.js third-party modules 所有