| id: GO-2023-1295 |
| modules: |
| - module: github.com/square/squalor |
| versions: |
| - fixed: 0.0.0-20200306154055-f6f0a47cc344 |
| vulnerable_at: 0.0.0-20190215211619-afa27bf1201c |
| packages: |
| - package: github.com/square/squalor |
| symbols: |
| - quoteName |
| - Table.loadColumns |
| - Table.loadKeys |
| derived_symbols: |
| - AliasedTableExpr.Serialize |
| - AndExpr.Serialize |
| - BinaryExpr.Serialize |
| - ColName.Serialize |
| - Columns.Serialize |
| - ComparisonExpr.Serialize |
| - DB.BindModel |
| - DB.Delete |
| - DB.DeleteContext |
| - DB.Exec |
| - DB.ExecContext |
| - DB.Get |
| - DB.GetContext |
| - DB.Insert |
| - DB.InsertContext |
| - DB.InsertIgnore |
| - DB.InsertIgnoreContext |
| - DB.MustBindModel |
| - DB.Query |
| - DB.QueryContext |
| - DB.QueryRow |
| - DB.QueryRowContext |
| - DB.Replace |
| - DB.ReplaceContext |
| - DB.Select |
| - DB.SelectContext |
| - DB.Update |
| - DB.UpdateContext |
| - DB.Upsert |
| - DB.UpsertContext |
| - Delete.Serialize |
| - FuncExpr.Serialize |
| - GroupBy.Serialize |
| - Insert.Serialize |
| - JoinTableExpr.Serialize |
| - Limit.Serialize |
| - LoadTable |
| - NonStarExpr.Serialize |
| - NotExpr.Serialize |
| - NullCheck.Serialize |
| - OnDup.Serialize |
| - OnJoinCond.Serialize |
| - OrExpr.Serialize |
| - Order.Serialize |
| - OrderBy.Serialize |
| - ParenBoolExpr.Serialize |
| - RangeCond.Serialize |
| - Select.Serialize |
| - SelectExprs.Serialize |
| - Serialize |
| - StandardLogger.Log |
| - StarExpr.Serialize |
| - TableExprs.Serialize |
| - TableName.Serialize |
| - TableNames.Serialize |
| - Tx.Delete |
| - Tx.DeleteContext |
| - Tx.Exec |
| - Tx.ExecContext |
| - Tx.Get |
| - Tx.GetContext |
| - Tx.Insert |
| - Tx.InsertContext |
| - Tx.InsertIgnore |
| - Tx.InsertIgnoreContext |
| - Tx.Query |
| - Tx.QueryContext |
| - Tx.QueryRow |
| - Tx.QueryRowContext |
| - Tx.Replace |
| - Tx.ReplaceContext |
| - Tx.Select |
| - Tx.SelectContext |
| - Tx.Update |
| - Tx.UpdateContext |
| - Tx.Upsert |
| - Tx.UpsertContext |
| - Update.Serialize |
| - UpdateExpr.Serialize |
| - UpdateExprs.Serialize |
| - UsingJoinCond.Serialize |
| - ValExprs.Serialize |
| - ValTuple.Serialize |
| - Values.Serialize |
| - Where.Serialize |
| summary: SQL injection in github.com/square/squalor |
| description: There is a potential for SQL injection in the table name parameter. |
| cves: |
| - CVE-2020-36645 |
| ghsas: |
| - GHSA-3hc7-2xcc-7p8f |
| references: |
| - report: https://github.com/square/squalor/pull/76 |
| - fix: https://github.com/square/squalor/pull/76/commits/033350b8596b397c6cefa066b1f2c83d35fc8c4a |
