TypeORM: SQL Injection in UpdateQueryBuilder/SoftDeleteQueryBuilder orderBy (MySQL/MariaDB)

Description

Blind SQL injection vulnerability in UpdateQueryBuilder and SoftDeleteQueryBuilder affecting MySQL and MariaDB users.

UpdateQueryBuilder and SoftDeleteQueryBuilder (including their addOrderBy variants) do not validate the order parameter against an allowlist of permitted values (ASC/DESC).

Recommendation

Update the typeorm package to the latest compatible version. Followings are version details:

• Affected version(s): >= 0.1.12, <= 0.3.28
• Patched version(s): 0.3.29

References

• GHSA-9ggv-8w38-r7pm
• CWE-89
• OWASP 2021-A3

Related Issues

• SQL Injection in typeorm - typeorm - Vulnerability
• Time Based SQL Injection - Vulnerability
• Possible SQL Injection - Vulnerability
• SQL injection in typeORM - CVE-2022-33171

You might also like:

How do hackers hack websites?

44 New SQL Injection Tests for WordPress in SmartScanner 1.8

These 7 PHP mistakes leave your website open to the hackers

Tags:

npm

typeorm