// For flags

CVE-2021-43822

SQL injection in jackalope/jackalope-doctrine-dbal

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWalker`: `XPath::escape($property)`. Node names and xpaths can contain `"` or `;` according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain `;`, you are not affected.

Jackalope Doctrine-DBAL es una implementación de la API de Repositorio de Contenido PHP (PHPCR) que usa una base de datos relacional para persistir los datos. En las versiones afectadas los usuarios pueden provocar inyecciones SQL si pueden especificar un nombre de nodo o una consulta. Actualice a versión 1.7.4 para resolver este problema. Si no es posible, puede escapar de todos los lugares donde es usado "$property" para filtrar "sv:name" en la clase "Jackalope\Transport\DoctrineDBAL\Query\QOMWalker": "XPath::escape($property)". Los nombres de nodo y los xpaths pueden contener """ o ";" según la especificación JCR. El componente jackalope que traduce el modelo de objetos de consulta en consultas dbal de la doctrina no escapa adecuadamente los nombres y rutas, por lo que un nombre de nodo convenientemente elaborado puede llevar a una inyección SQL. Si las consultas nunca son realizadas a partir de la entrada del usuario, o si es comprobada la entrada del usuario para que no contenga ";", no está afectado

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-11-16 CVE Reserved
  • 2021-12-13 CVE Published
  • 2023-07-06 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Jackalope Doctrine-dbal Project
Search vendor "Jackalope Doctrine-dbal Project"
 Jackalope Doctrine-dbal
Search vendor "Jackalope Doctrine-dbal Project" for product "Jackalope Doctrine-dbal"
 < 1.7.4
Search vendor "Jackalope Doctrine-dbal Project" for product "Jackalope Doctrine-dbal" and version " < 1.7.4"
-
Affected