XSS in SQL::Abstract::Tree before 2.000001_04
SQL::Abstract::Tree does not escape SQL text or bind values in the html profile before inserting into HTML markup. Attackers controlling bind values or SQL text in a debug panel or query log can inject JavaScript. This affects users of versions before 2.000001_04.
What to do: Upgrade to SQL::Abstract::Tree 2.000001_04. No workaround provided.
| Product | Affected | Fixed in |
|---|---|---|
| Perl SQL::Abstract::Tree | before 2.000001_04 | 2.000001_04 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup. An application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page.
Versions before 2.000001_04 allow SQL injection via where values in identifier position and XSS via unescaped SQL text and bind values.
Today 1.5K readers · 2.4K views · 768 reads · all time 189K views