Description
SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter.
Remediation
References
https://blog.jiguang.xyz/posts/thinkjs-sql-injection/
https://github.com/thinkjs/thinkjs
Related Vulnerabilities
CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.insteon
CVE-2022-25301 Vulnerability in npm package jsgui-lang-essentials
CVE-2021-21350 Vulnerability in maven package com.thoughtworks.xstream:xstream
CVE-2021-46384 Vulnerability in maven package net.mingsoft:ms-mcms