Executive brief
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
Affected products
- PyPI SQLAlchemy
Junglewise Threat Intelligence
PYSEC-2019-53 - SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
Severity: info · Published 2019-02-20
Technologies: SQLAlchemy (PyPI). Vendors: PyPI.
Related threats
- SQLAlchemy vulnerable to SQL Injection via order_by parameter
- PYSEC-2019-124 - SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
- PYSEC-2019-54 - SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
- PYSEC-2012-9 - Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL co