SQL Injection in liftkit/database

严重 9.8CVE-2016-15020 · GHSA-8hcf-2m4v-f2rq · Published 16/01/2023 · updated 17/06/2026

要点

CVE-2016-15020 是影响 liftkit/database, liftkit database library (liftkit database library project) 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：0.70%，高于 53.5% 的漏洞。
修复：升级到 2.13.2 或更高版本。

Package	Affected versions	Patched versions
liftkit/database Packagist	`< 2.13.2`	`2.13.2`
liftkit database library liftkit_database_library_project	`< 2.13.2`	`2.13.2`

Description

A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/Query.php. The manipulation leads to sql injection. Upgrading to version 2.13.2 is able to address this issue. The name of the patch is 42ec8f2b22e0b0b98fb5b4444ed451c1b21d125a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218391.

NVD description

A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/Query.php. The manipulation leads to sql injection. Upgrading to version 2.13.2 is able to address this issue. The patch is named 42ec8f2b22e0b0b98fb5b4444ed451c1b21d125a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218391.

References

nvd.nist.gov/vuln/detail/CVE-2016-15020 · ADVISORY
liftkit/database commit 42ec8f2 · WEB
liftkit/database · PACKAGE
liftkit/database release v2.13.2 · WEB
vuldb.com · WEB
vuldb.com · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

liftkit/database

Packagist

< 2.13.2

2.13.2

liftkit database library

liftkit_database_library_project

< 2.13.2

2.13.2

Description

NVD description

A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/Query.php. The manipulation leads to sql injection. Upgrading to version 2.13.2 is able to address this issue. The patch is named 42ec8f2b22e0b0b98fb5b4444ed451c1b21d125a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218391.