| Package | Affected versions | Patched versions |
|---|---|---|
| arches | ≥ 6.2.0, < 6.2.1≥ 7.0.0, < 7.2.0< 6.1.2 | 6.2.17.2.06.1.2 |
| arches | = 6.2.0= 7.0.0= 7.1.0= 7.1.1≤ 6.1.1 |
With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database.
Anyone running the impacted versions (<=6.1.1, 6.2.0, >=7.0.0, <=7.1.1) should upgrade as soon as possible.
The problem has been patched in the following versions: 6.1.2, 6.2.1, and 7.2.0 Users are strongly urged to upgrade to the most recent relevant patch.
There are no workarounds.
https://www.w3schools.com/sql/sql_injection.asp https://en.wikipedia.org/wiki/SQL_injection
Post any questions to the Arches project forum.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free