The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
Historical advisory saved 1 Nov 2026 23:02:15 UTC. The publisher may have updated it since then. Latest advisory.
euvd · EUVD-2022-1087
PublishedThe query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
Additional publisher context
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Jan 29, 2022, 10:53:01 PM
dateUpdated: Aug 3, 2024, 3:59:23 AM
- Source published
- Jan 29, 2022, 10:53:01 PM (timezone not stated)
- Source modified
- Aug 3, 2024, 3:59:23 AM (timezone not stated)
- Saved here
- 1 Nov 2026 23:02:15 UTC
- Source terms
- ENISA EUVD · source terms and attribution apply
Original source record · Cite this exact observation · Complete original publisher JSON
Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.