The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html | Exploit Third Party Advisory VDB Entry |
| https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1 | Release Notes Third Party Advisory |
| https://github.com/casdoor/casdoor/issues/439 | Exploit Issue Tracking Patch Third Party Advisory |
| https://github.com/casdoor/casdoor/pull/442 | Exploit Patch Third Party Advisory |
| http://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html | Exploit Third Party Advisory VDB Entry |
| https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1 | Release Notes Third Party Advisory |
| https://github.com/casdoor/casdoor/issues/439 | Exploit Issue Tracking Patch Third Party Advisory |
| https://github.com/casdoor/casdoor/pull/442 | Exploit Patch Third Party Advisory |
Configurations
History
21 Nov 2024, 06:49
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html - Exploit, Third Party Advisory, VDB Entry | |
| References | () https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1 - Release Notes, Third Party Advisory | |
| References | () https://github.com/casdoor/casdoor/issues/439 - Exploit, Issue Tracking, Patch, Third Party Advisory | |
| References | () https://github.com/casdoor/casdoor/pull/442 - Exploit, Patch, Third Party Advisory |
Information
Published : 2022-01-29 23:15
Updated : 2024-11-21 06:49
NVD link : CVE-2022-24124
Mitre link : CVE-2022-24124
CVE.ORG link : CVE-2022-24124
JSON object : View
Products Affected
casbin
- casdoor
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')