CVE-2015-9244

Keys of objects in mysql node module v2.0.0-alpha7 and earlier are not escaped with `mysql.escape()` which could lead to SQL Injection.

Score

CVSS 3.1 9.8 Critical

Status

Modified - support@hackerone.com

Published

2018-05-29

Last modified

2024-09-16

Weaknesses

CWE-89

Affected products

• Mysql Node Module (Hackerone)
• Mysql (Mysqljs)

References

• https://github.com/felixge/node-mysql/issues/342
• https://nodesecurity.io/advisories/66