SQLAlchemy vulnerable to SQL Injection via order_by parameter
Critical severity
GitHub Reviewed
Published
Apr 16, 2019
to the GitHub Advisory Database
•
Updated Sep 1, 2023
Description
Published by the National Vulnerability Database
Feb 20, 2019
Published to the GitHub Advisory Database
Apr 16, 2019
Reviewed
Jun 16, 2020
Last updated
Sep 1, 2023
SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
References