Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/elgs/gosqljson

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8GoPublished

    gosqljson SQL Injection vulnerability

    CVE-2014-125064 · GHSA-g7mw-9pf9-p2pm

    Affected
    • Go github.com/elgs/gosqljson < 0.0.0-20220916234230-750f26ee23c7
    Fixed in
    0.0.0-20220916234230-750f26ee23c7· Vendor fix available
    Issue
    A vulnerability, which was classified as critical, has been found in elgs gosqljson. This issue affects the function QueryDbToArray/QueryDbToMap/ExecDb of the file gosqljson.go. The manipulation of the argument sqlStatement leads to sql injection. The name of the patch is 2740b331546cb88eb61771df4c07d389e9f0363a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217631.

    Recommended action: Upgrade to 0.0.0-20220916234230-750f26ee23c7 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →