GO-2022-0303Published
The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2022-24124 · Microsoft / collected KEV context
cve-program · CVE-2022-24124
- https://github.com/casdoor/casdoor/issues/439
- https://github.com/casdoor/casdoor/pull/442
- https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1
- http://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html
euvd · EUVD-2022-1087
- https://github.com/casdoor/casdoor/issues/439
- https://github.com/casdoor/casdoor/pull/442
- https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1
- http://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html
nvd · CVE-2022-24124
- http://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html
- https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1
- https://github.com/casdoor/casdoor/issues/439
- https://github.com/casdoor/casdoor/pull/442
osv · GHSA-m358-g4rp-533r
- https://nvd.nist.gov/vuln/detail/CVE-2022-24124
- https://github.com/casdoor/casdoor/issues/439
- https://github.com/casdoor/casdoor/pull/442
- https://github.com/casdoor/casdoor/commit/5ec0c7a89005819960d8fe07f5ddda13d1371b8c
- https://github.com/casdoor/casdoor
- https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1
- http://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html
osv · GO-2022-0303
- https://github.com/advisories/GHSA-m358-g4rp-533r
- https://nvd.nist.gov/vuln/detail/CVE-2022-24124
- https://github.com/casdoor/casdoor/commit/5ec0c7a89005819960d8fe07f5ddda13d1371b8c
- https://github.com/casdoor/casdoor/pull/442
- https://github.com/casdoor/casdoor/issues/439
- http://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html
- https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.