Executive brief
nodebatis is a lightweight Node.js SQL query builder library used to construct and execute database queries. An SQL injection vulnerability in the SQL builder component allows attackers to inject arbitrary SQL code, potentially exposing sensitive data, modifying database content, or gaining unauthorized access to backend systems.
Technical details
The vulnerability is a classic SQL injection (CWE-89) in the SQL builder component of nodebatis. The vulnerable code fails to properly sanitize or parameterize user input when constructing SQL queries, allowing an attacker to inject malicious SQL commands. The attack is network-accessible and requires no authentication or special privileges. An attacker can achieve arbitrary SQL execution, including data exfiltration, modification, or deletion, and potential remote code execution depending on database permissions. The issue was patched in version 2.2.0 (commit 6629ff5b7e3d62ad8319007a54589ec1f62c7c35 from January 2018), and upgrading to this version resolves the vulnerability.
Affected products
- PeterMu nodebatis up to 2.1.x
Timeline
- 2023-01-06: disclosed: GHSA advisory published
- 2018-01-13: patched: Fix committed; version 2.2.0 released
- 2023-01-12: other: GitHub security review completed