Homepage

SQL Injection The advisory has been revoked - it doesn't affect any version of package mariadb-10.6  (opens in a new tab)

Threat Intelligence

EPSS
0.13% (49th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about SQL Injection vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-WOLFILATEST-MARIADB106-6262845
  • published22 Feb 2024
  • disclosed19 Feb 2024
Report a new vulnerability Found a mistake?

Introduced: 19 Feb 2024

CVE-2024-1597  (opens in a new tab)
CWE-89  (opens in a new tab)

Amendment

The Wolfi security team deemed this advisory irrelevant for Wolfi:latest.

NVD Description

Note: Versions mentioned in the description apply only to the upstream mariadb-10.6 package and not the mariadb-10.6 package as distributed by Wolfi.

pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a string value after the first placeholder; both must be on the same line. By constructing a matching string payload, the attacker can inject SQL to alter the query,bypassing the protections that parameterized queries bring against SQL Injection attacks. Versions before 42.7.2, 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42.2.28 are affected.