SQL Injection Affecting thinkjs package, versions *
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.2% (59th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-THINKJS-1066412
- published 2 Feb 2021
- disclosed 2 Feb 2021
- credit Unknown
Introduced: 2 Feb 2021
CVE-2020-21176 Open this link in a new tabHow to fix?
There is no fixed version for thinkjs
.
Overview
thinkjs is a ThinkJS - Use full ES6+ features to develop web applications
Affected versions of this package are vulnerable to SQL Injection in the model.increment
and model.decrement
. It allows remote attackers to execute arbitrary SQL commands via the step
parameter.
References
CVSS Scores
version 3.1