CVE-2021-4262

laravel-jqgrid EloquentRepositoryAbstract.php getRows sql injection

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability classified as critical was found in laravel-jqgrid. Affected by this vulnerability is the function getRows of the file src/Mgallegos/LaravelJqgrid/Repositories/EloquentRepositoryAbstract.php. The manipulation leads to sql injection. The name of the patch is fbc2d94f43d0dc772767a5bdb2681133036f935e. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216271.

Una vulnerabilidad fue encontrada en laravel-jqgrid y clasificada como crítica. La función getRows del archivo src/Mgallegos/LaravelJqgrid/Repositories/EloquentRepositoryAbstract.php es afectada por esta vulnerabilidad. La manipulación conduce a la inyección de SQL. El nombre del parche es fbc2d94f43d0dc772767a5bdb2681133036f935e. Se recomienda aplicar un parche para solucionar este problema. El identificador asociado de esta vulnerabilidad es VDB-216271.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-12-19 CVE Reserved
2022-12-19 CVE Published
2024-07-11 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-707: Improper Neutralization

CAPEC

References (3)

URL	Tag	Source
https://vuldb.com/?id.216271	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://github.com/mgallegos/laravel-jqgrid/commit/fbc2d94f43d0dc772767a5bdb2681133036f935e	2023-11-07
https://github.com/mgallegos/laravel-jqgrid/pull/72	2023-11-07

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Laravel Jqgrid Project Search vendor "Laravel Jqgrid Project"		Laravel Jqgrid Search vendor "Laravel Jqgrid Project" for product "Laravel Jqgrid"				< 2017-10-09 Search vendor "Laravel Jqgrid Project" for product "Laravel Jqgrid" and version " < 2017-10-09"		-		Affected