{"id":"EUVD-2022-1087","enisaUuid":"0faadb28-3d44-3cd8-836d-952550aa2056","description":"The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.","datePublished":"Jan 29, 2022, 10:53:01 PM","dateUpdated":"Aug 3, 2024, 3:59:23 AM","baseScore":null,"references":"https://github.com/casdoor/casdoor/issues/439\nhttps://github.com/casdoor/casdoor/pull/442\nhttps://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1\nhttp://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html\n","aliases":"CVE-2022-24124\nGHSA-m358-g4rp-533r\n","assigner":"mitre","epss":55.3,"enisaIdProduct":[{"id":"bb4ce88a-853a-39c7-8203-97ce632c3faf","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"enisaIdVendor":[{"id":"c2ceba18-6f30-353e-8b23-cc119728928a","vendor":{"name":"n/a"}}],"enisaIdVulnerability":[{"id":"430ea28a-6929-329f-9cbc-014af2373ca9","vulnerability":{"id":"CVE-2022-24124","description":"The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.","datePublished":"Jan 29, 2022, 10:53:01 PM","dateUpdated":"Aug 3, 2024, 3:59:23 AM","status":"PUBLISHED","baseScore":null,"references":"https://github.com/casdoor/casdoor/issues/439\nhttps://github.com/casdoor/casdoor/pull/442\nhttps://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1\nhttp://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html\n","enisa_id":"EUVD-2022-1087\n","assigner":"mitre","epss":55.3,"dataProcessed":"Nov 1, 2026, 7:16:01 AM","vulnerabilityProduct":[{"id":"61143243-f364-34e0-b9f9-47e71a5b2fab","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"vulnerabilityVendor":[{"id":"49181db0-efe1-3090-991b-2ea41814d957","vendor":{"name":"n/a"}}]}},{"id":"720bf2a7-29a0-3093-9fa4-e7606676d8f3","vulnerability":{"id":"GHSA-m358-g4rp-533r","description":"SQL Injection in Casdoor","datePublished":"Feb 1, 2022, 12:49:39 AM","dateUpdated":"Feb 7, 2022, 9:15:30 PM","baseScore":null,"references":"https://nvd.nist.gov/vuln/detail/CVE-2022-24124\nhttps://github.com/casdoor/casdoor/issues/439\nhttps://github.com/casdoor/casdoor/pull/442\nhttps://github.com/casdoor/casdoor/commit/5ec0c7a89005819960d8fe07f5ddda13d1371b8c\nhttps://github.com/casdoor/casdoor\nhttps://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1\nhttp://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html\n","enisa_id":"EUVD-2022-1087\n","aliases":"CVE-2022-24124\nGHSA-m358-g4rp-533r\n","epss":0.0,"dataProcessed":"Apr 21, 2026, 4:04:12 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f04e3329-6d77-3f28-9317-b8023fc086c5","vulnerability":{"id":"PYSEC-2022-43189","description":"The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.","datePublished":"Jan 29, 2022, 11:15:07 PM","dateUpdated":"Oct 4, 2026, 9:41:52 AM","baseScore":0.0,"references":"https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1\nhttps://github.com/casdoor/casdoor/issues/439\nhttps://github.com/casdoor/casdoor/pull/442\nhttp://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html\n","enisa_id":"EUVD-2022-1087\n","aliases":"CVE-2022-24124\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:18:06 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}