Description
SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter.
Remediation
References
https://blog.jiguang.xyz/posts/thinkjs-sql-injection/
https://github.com/thinkjs/thinkjs
Related Vulnerabilities
CVE-2017-0930 Vulnerability in npm package augustine
CVE-2020-8127 Vulnerability in maven package org.webjars:reveal.js
CVE-2020-7723 Vulnerability in npm package promisehelpers
CVE-2018-8108 Vulnerability in npm package bui
CVE-2023-29213 Vulnerability in maven package org.xwiki.platform:xwiki-platform-logging-script