CVE-2022-24752
SQL Injection through sorting parameters in SyliusGridBundle
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
SyliusGridBundle is a package of generic data grids for Symfony applications. Prior to versions 1.10.1 and 1.11-rc2, values added at the end of query sorting were passed directly to the database. The maintainers do not know if this could lead to direct SQL injections but took steps to remediate the vulnerability. The issue is fixed in versions 1.10.1 and 1.11-rc2. As a workaround, overwrite the`Sylius\Component\Grid\Sorting\Sorter.php` class and register it in the container. More information about this workaround is available in the GitHub Security Advisory.
SyliusGridBundle es un paquete de grids de datos genéricos para aplicaciones Symfony.En versiones anteriores a 1.10.1 y 1.11-rc2, los valores añadidos al final de la ordenación de la consulta eran pasados directamente a la base de datos. Los mantenedores no saben si esto podría conllevar a inyecciones SQL directas, pero tomaron medidas para remediar la vulnerabilidad. El problema ha sido corregido en versiones 1.10.1 y 1.11-rc2. Como medida de mitigación, sobrescriba la clase "Sylius\Component\Sorting\Sorter.php" y regístrela en el contenedor. Se presenta más información sobre esta mitigación en el aviso de seguridad de GitHub
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-02-10 CVE Reserved
- 2022-03-15 CVE Published
- 2023-10-06 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://github.com/Sylius/SyliusGridBundle/releases/tag/v1.10.1 | Release Notes | |
| https://github.com/Sylius/SyliusGridBundle/releases/tag/v1.11.0-RC.2 | Release Notes | |
| https://github.com/Sylius/SyliusGridBundle/security/advisories/GHSA-2xmm-g482-4439 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/Sylius/SyliusGridBundle/commit/73d0791d0575f955e830a3da4c3345f420d2f784 | 2022-03-25 | |
| https://github.com/Sylius/SyliusGridBundle/pull/222 | 2022-03-25 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Sylius Search vendor "Sylius" | Syliusgridbundle Search vendor "Sylius" for product "Syliusgridbundle" | < 1.10.1 Search vendor "Sylius" for product "Syliusgridbundle" and version " < 1.10.1" | - |
Affected
| ||||||
| Sylius Search vendor "Sylius" | Syliusgridbundle Search vendor "Sylius" for product "Syliusgridbundle" | 1.11.0 Search vendor "Sylius" for product "Syliusgridbundle" and version "1.11.0" | - |
Affected
| ||||||
| Sylius Search vendor "Sylius" | Syliusgridbundle Search vendor "Sylius" for product "Syliusgridbundle" | 1.11.0 Search vendor "Sylius" for product "Syliusgridbundle" and version "1.11.0" | alpha1 |
Affected
| ||||||
| Sylius Search vendor "Sylius" | Syliusgridbundle Search vendor "Sylius" for product "Syliusgridbundle" | 1.11.0 Search vendor "Sylius" for product "Syliusgridbundle" and version "1.11.0" | beta1 |
Affected
| ||||||
| Sylius Search vendor "Sylius" | Syliusgridbundle Search vendor "Sylius" for product "Syliusgridbundle" | 1.11.0 Search vendor "Sylius" for product "Syliusgridbundle" and version "1.11.0" | rc1 |
Affected
| ||||||