Is CVE-2015-9244 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2015-9244 being exploited in the wild.

How severe is CVE-2015-9244?

Informational severity, published 1 September 2020.

Which products and versions are affected?

mysql (npm) SEMVER:introduced=0,fixed=2.0.0-alpha8.

Is there a fix for CVE-2015-9244?

Yes. mysql (npm): upgrade to 2.0.0-alpha8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2015-9244 attacked?

It is attacked over the network.

Am I affected by CVE-2015-9244?

Check whether you run mysql (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2015-9244: mysql SQL injection in escape function

CVE-2015-9244 · Severity: info · Published 2020-09-01

The mysql Node.js library contains a SQL injection vulnerability in its escape() function, which fails to properly escape object keys. An attacker could inject arbitrary SQL code by passing specially crafted input, potentially leading to unauthorized database access, data manipulation, or data exfiltration.

Technologies: mysql (npm). Vendors: npm.

Quick answers

Is CVE-2015-9244 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2015-9244 being exploited in the wild.
How severe is CVE-2015-9244?: Informational severity, published 1 September 2020.
Which products and versions are affected?: mysql (npm) SEMVER:introduced=0,fixed=2.0.0-alpha8.
Is there a fix for CVE-2015-9244?: Yes. mysql (npm): upgrade to 2.0.0-alpha8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2015-9244 attacked?: It is attacked over the network.
Am I affected by CVE-2015-9244?: Check whether you run mysql (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mysql (npm): upgrade to 2.0.0-alpha8 or later
```
npm install mysql@2.0.0-alpha8
```

Technical details

The vulnerability is a SQL injection flaw (CWE-89) in the mysql.escape() function in the Node.js mysql library. The root cause is improper escaping of object keys during SQL query construction. An attacker can exploit this by supplying malicious object keys that bypass the escape mechanism, allowing arbitrary SQL injection. The attack requires control over input passed to the escape() function, but does not require authentication. The vulnerability affects all versions prior to 2.0.0-alpha8, which includes the fix.

Affected products

npm mysql < 2.0.0-alpha8

Identifiers

CVE-2015-9244
GHSA-fvq6-55gv-jx9f

Timeline

2020-09-01: disclosed
2.0.0-alph: patched

References

https://github.com/felixge/node-mysql/issues/342

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.