SQL injection in SQL::Abstract before 2.000001_04
SQL::Abstract for Perl allows SQL injection in versions before 2.000001_04 when passing untrusted input as the where value of a nested statement in an identifier position such as the select list or ORDER BY. Applications using such nested statements with untrusted data are vulnerable. Attackers can inject arbitrary SQL to execute on the database. Affected are users of SQL::Abstract versions 1.90_01 through 2.000001_03.
What to do: Upgrade to SQL::Abstract 2.000001_04 or later. No workaround mentioned.
| Product | Affected | Fixed in |
|---|---|---|
| CPAN SQL-Abstract | 1.90_01 before 2.000001_04 | 2.000001_04 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as { -select => ... } in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These positions are the select list, ORDER BY, GROUP BY, RETURNING, and with the ExtraClauses plugin FROM (-as) and JOIN (to). The values of the statement's where, having and set clauses, and the rows of a -values, go into the SQL text instead of the bind list, unescaped unless quote_char is set. Subselects in a WHERE condition are not affected. An application that passes untrusted input as a where value of such a nested statement, expecting it to be bound, allows SQL injection.
Versions before 2.000001_04 allow SQL injection via where values in identifier position and XSS via unescaped SQL text and bind values.
Today 1.5K readers · 2.4K views · 757 reads · all time 189K views