CVE-2016-10551

CRITICAL

waterline-sequel < 0.5.1 - SQL Injection via Like/Contains/StartsWith/EndsWith Input

Title source: llm

Description

waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline's `like`, `contains`, `startsWith`, or `endsWith` will end up in waterline-sequel with the potential for malicious code. A malicious user can input their own SQL statements in waterline-sequel 0.50 that will get executed and have full access to the database.

References (2)

Core 2

Core References

Exploit, Issue Tracking, Third Party Advisory x_refsource_misc

https://github.com/balderdashy/waterline/issues/1219#issuecomment-157294530

Third Party Advisory x_refsource_misc

https://nodesecurity.io/advisories/115

Scores

CVSS v3 9.8

EPSS 0.0182

EPSS Percentile 76.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-89

Status published

Products (2)

balderdash/waterline-sequel 0.5.0

npm/waterline-sequel 0 - 0.5.1npm

Published May 29, 2018

Tracked Since Feb 18, 2026