Description (CNA)
sequelize is an Object-relational mapping, or a middleman to convert things from Postgres, MySQL, MariaDB, SQLite and Microsoft SQL Server into usable data for NodeJS If user input goes into the `limit` or `order` parameters, a malicious user can put in their own SQL statements. This affects sequelize 3.16.0 and earlier.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| HackerOne / sequelize node module | affected <= 3.16.0 |
CWE
CWE-89
References
- https://nodesecurity.io/advisories/112
- https://github.com/sequelize/sequelize/pull/5167/commits/f282d85e60e3df5e57ecdb82adccb4eaef404f03
ADP enrichment
No English description supplied.