Executive brief
waterline-sequel is a SQL query builder library used in Node.js web applications. A SQL injection vulnerability allows attackers to bypass query filters by injecting malicious SQL code through the like, contains, startsWith, or endsWith methods, potentially exposing or modifying database records without authorization.
Technical details
The vulnerability is a classic SQL injection (CWE-89) in the waterline-sequel query builder library. The affected methods (like, contains, startsWith, endsWith) do not properly sanitize user input before constructing SQL queries, allowing attackers to inject SQL operators and comments (e.g., " OR 1=1; --). The flaw affects all versions prior to 0.5.1. Exploitation requires the attacker to control input passed to these filtering methods, typically via web request parameters. An attacker can execute arbitrary SQL queries to read, modify, or delete database records. The fix was released in version 0.5.1 via proper input parameterization.
Affected products
- balderdashy waterline-sequel < 0.5.1
Timeline
- 2015-11-17: disclosed
- 2016: patched: Fixed in version 0.5.1
- 2019-02-18: advisory: Published to GitHub Advisory Database as CVE-2016-10551