CVE-2015-1369
highpriority · track · 31EPSS 0.021 · 82 %ileEUUSEPSS · scored 2026-10-27
SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.4–7.5
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-xqg8-cv3h-xppvSQL Injection in sequelize2017-10-24ghsa · osvUS
Versions 2.0.0-rc-7 and earlier of `sequelize` are affected by a SQL injection vulnerability when user input is passed into the order parameter. ## Proof of Concept ```javascript Test.findAndCountAll({ where: { id :1 }, order : [['id', 'UNTRUSTED USER INPUT']] }) ``` ## Recommendation Update to version 2.0.0-rc8 or later
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (9)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2015/01/23/2cnnvd
- https://github.com/sequelize/sequelize/pull/2919cnnvd
- https://nodesecurity.io/advisories/sequelize-sql-injection-ordercnnvd
- http://www.openwall.com/lists/oss-security/2015/01/23/2enisa_euvd
- https://github.com/sequelize/sequelize/pull/2919enisa_euvd
- https://nodesecurity.io/advisories/sequelize-sql-injection-orderenisa_euvd
- http://www.openwall.com/lists/oss-security/2015/01/23/2nvd
- https://github.com/sequelize/sequelize/pull/2919Exploitnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan