Executive brief
query-mysql is a Node.js library for executing MySQL database queries. The library fails to sanitize user input, allowing attackers to inject arbitrary SQL commands and extract, modify, or delete sensitive data from connected databases. Applications using this library with untrusted input are at immediate risk of data breach.
Technical details
SQL injection vulnerability (CWE-89) in the query-mysql npm module due to insufficient input validation. The library does not properly escape or parameterize user-supplied input before constructing SQL queries, allowing an attacker to inject malicious SQL syntax. Attack requires the attacker to control input data passed to the module's query functions; no authentication or special privileges are needed if the application exposes the vulnerable code path to external input. An attacker can execute arbitrary SQL commands with the privileges of the database connection, potentially reading sensitive data, modifying records, or disrupting service. No patch has been released; the vulnerability affects all versions including 0.0.2 and prior.
Affected products
- npm query-mysql all versions up to 0.0.2
Timeline
- 2018-09-10: disclosed: Published in GitHub Advisory Database