{"id":"GHSA-265q-222x-52m6","aliases":[],"title":"silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"A potential SQL injection vulnerability was identified by using the silverstripe/postgresql database adapter. While unlikely to be exploitable, we have patched silverstripe/framework to ensure that table names are safely escaped before being passed to database adapters or user code.","severity":"high","score":8.8,"published":"2024-05-28T13:01:48.000Z","modified":"2024-12-03T06:23:59.669Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"silverstripe/framework","sources":[{"name":"OSV · GHSA-265q-222x-52m6","url":"https://osv.dev/vulnerability/GHSA-265q-222x-52m6"}],"ranges":[{"events":[{"introduced":"4.0.0-rc1"},{"fixed":"4.0.6"}],"type":"ECOSYSTEM"}],"versions":["4.0.0","4.0.0-rc1","4.0.0-rc2","4.0.0-rc3","4.0.1","4.0.1-rc1","4.0.2","4.0.3","4.0.4","4.0.5"],"fixed":["4.0.6"]},{"ecosystem":"Packagist","name":"silverstripe/framework","sources":[{"name":"OSV · GHSA-265q-222x-52m6","url":"https://osv.dev/vulnerability/GHSA-265q-222x-52m6"}],"ranges":[{"events":[{"introduced":"4.1.0-rc1"},{"fixed":"4.1.4"}],"type":"ECOSYSTEM"}],"versions":["4.1.0","4.1.0-rc1","4.1.0-rc2","4.1.1","4.1.2","4.1.3"],"fixed":["4.1.4"]},{"ecosystem":"Packagist","name":"silverstripe/framework","sources":[{"name":"OSV · GHSA-265q-222x-52m6","url":"https://osv.dev/vulnerability/GHSA-265q-222x-52m6"}],"ranges":[{"events":[{"introduced":"4.2.0-rc1"},{"fixed":"4.2.3"}],"type":"ECOSYSTEM"}],"versions":["4.2.0","4.2.1","4.2.2"],"fixed":["4.2.3"]}],"sourceAffected":[],"references":["https://github.com/silverstripe/silverstripe-framework/commit/48bd335648188df9dae72be1e5f9c808f3fe1e77","https://github.com/silverstripe/silverstripe-framework/commit/fecedc2d98eeaaff6424fb59dc70ef6bdc6dc92d","https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2018-020-1.yaml","https://github.com/silverstripe/silverstripe-framework","https://www.silverstripe.org/download/security-releases/ss-2018-020"],"sources":[{"name":"OSV","id":"GHSA-265q-222x-52m6","modified":"2024-12-03T06:23:59.669492Z","url":"https://osv.dev/vulnerability/GHSA-265q-222x-52m6"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}],"products":[],"remediation":[],"kev":{"status":"unavailable","checkedAt":"2026-10-29T02:40:30.803Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}