SQL Injection Affecting mysql-connector-python package, versions [,8.0.11)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about SQL Injection vulnerabilities in an interactive lesson.

Start learning

Snyk IDSNYK-PYTHON-MYSQLCONNECTORPYTHON-8320935
published1 Nov 2024
disclosed1 Nov 2024
creditUnknown

Report a new vulnerability Found a mistake?

Introduced: 1 Nov 2024

CWE-89 (opens in a new tab)

How to fix?

Upgrade mysql-connector-python to version 8.0.11 or higher.

Overview

mysql-connector-python is a MySQL driver written in Python which does not depend on MySQL C client libraries and implements the DB API v2.0 specification (PEP-249).

Affected versions of this package are vulnerable to SQL Injection due to improper sanitization of schema and table names.

References

GitHub Commit

CVSS Scores

version 4.0

version 3.1

Attack Vector (AV)
Network
Attack Complexity (AC)
Low
Attack Requirements (AT)
None
Privileges Required (PR)
None
User Interaction (UI)
None

Confidentiality (VC)
None
Integrity (VI)
Low
Availability (VA)
None

Confidentiality (SC)
Low
Integrity (SI)
Low
Availability (SA)
Low