The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html | Exploit Third Party Advisory VDB Entry |
| https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1 | Release Notes Third Party Advisory |
| https://github.com/casdoor/casdoor/issues/439 | Exploit Issue Tracking Patch Third Party Advisory |
| https://github.com/casdoor/casdoor/pull/442 | Exploit Patch Third Party Advisory |
Configurations
History
05 Apr 2022, 20:21
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) http://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html - Exploit, Third Party Advisory, VDB Entry |
28 Feb 2022, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
04 Feb 2022, 15:44
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/casdoor/casdoor/issues/439 - Exploit, Issue Tracking, Patch, Third Party Advisory | |
| References | (MISC) https://github.com/casdoor/casdoor/pull/442 - Exploit, Patch, Third Party Advisory | |
| References | (MISC) https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1 - Release Notes, Third Party Advisory | |
| CPE | cpe:2.3:a:casbin:casdoor:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
| CWE | CWE-89 |
29 Jan 2022, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-01-29 23:15
Updated : 2024-02-04 22:08
NVD link : CVE-2022-24124
Mitre link : CVE-2022-24124
CVE.ORG link : CVE-2022-24124
JSON object : View
Products Affected
casbin
- casdoor
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')