Executive brief
resquel is a JavaScript library used to build and manage database queries. A SQL injection vulnerability in the query parameter handling allows attackers to inject malicious SQL commands and execute arbitrary database operations, potentially leading to data theft, modification, or deletion.
Technical details
The vulnerability is a classic SQL injection (CWE-89) affecting all versions of resquel. Query parameters are not properly sanitized before being incorporated into SQL statements, allowing unauthenticated network attackers to inject arbitrary SQL code through user-controlled input. An attacker can execute any SQL query the compromised database connection permits, including data extraction, modification, or deletion. No patch is currently available; users should consider switching to an alternative package.
Affected products
- npm resquel all versions
Timeline
- 2020-09-11: disclosed
- 2020-08-31: advisory