Description
SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter.
Remediation
References
https://blog.jiguang.xyz/posts/thinkjs-sql-injection/
https://github.com/thinkjs/thinkjs
Related Vulnerabilities
CVE-2022-0624 Vulnerability in npm package parse-path
CVE-2016-4055 Vulnerability in maven package org.webjars.npm:moment
CVE-2021-23452 Vulnerability in npm package x-assign
CVE-2023-43497 Vulnerability in maven package org.jenkins-ci.main:jenkins-core
CVE-2023-50102 Vulnerability in maven package com.jfinal:jfinal