org.webjars.npm:pg-promise@5.6.4 vulnerabilities

org.webjars.npm:pg-promise is a PostgreSQL interface for Node.js

Affected versions of this package are vulnerable to SQL Injection when using the simple query mode. Since pgFormatting is enabled by default, pg-promise escapes parameter values before inserting them into a query string.

When a placeholder is directly preceded by a minus - and not separated by any whitespace, pg-promise does not handle the particular case when a negative number is inserted for the placeholder. This leads to two consecutive minus signs in the query, turning them into the start of a line comment.

Note:

To exploit this behavior and cause SQL Injection, the following conditions must be met by a parameterized query:

1. a placeholder for a numeric value must be immediately preceded by a minus (as described above).

2. there must be a second placeholder for a string value after the first placeholder; both must be on the same line.

3. both parameter values must be user-controlled

There is no fixed version for org.webjars.npm:pg-promise.