SQL Injection in Query-Mysql Project
CVE-2018-3754
Node.js third-party module query-mysql versions 0.0.0, 0.0.1, and 0.0.2 are vulnerable to an SQL injection vulnerability due to lack of user input sanitization. This may allow an attacker to run arbitrary SQL queries when fetching data from database.
Vulnerability class: SQL Injection
EPSS: 0.012 (65.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Query-mysql_project Query-mysql — versions 0.0.0, 0.0.1, 0.0.2
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- support@hackerone.com (Exploit, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2018-3754?
- CVE-2018-3754 is a high-severity vulnerability in Query-Mysql Project, classified under SQL Injection. CVSS score: 8.8/10. Published 2018-07-03.
- How severe is CVE-2018-3754?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2018-3754 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.