CVE-2020-21176 - SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter

Back Back to CVE browser

HIGH

SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter

Published Feb 1, 2021

9.8

HIGH

CVSS 3.1

EPSS 1.49%

Description

SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter.

Affected products

Ecosystem	Package	Introduced	Fixed
npm	thinkjs	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (4)

https://blog.jiguang.xyz/posts/thinkjs-sql-injection/
x_refsource_MISCExploitThird Party Advisory
https://github.com/advisories/GHSA-q5mq-6fjg-4mw8
Advisory
https://github.com/thinkjs/thinkjs
x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-21176

Link	Providers	Tags
https://blog.jiguang.xyz/posts/thinkjs-sql-injection/		x_refsource_MISCExploitThird Party Advisory
https://github.com/advisories/GHSA-q5mq-6fjg-4mw8		Advisory
https://github.com/thinkjs/thinkjs		x_refsource_MISCThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-21176