CVE-2016-15020

low-risk
Published 2023-01-16

A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/Query.php. The manipulation leads to sql injection. Upgrading to version 2.13.2 is able to address this issue. The patch is named 42ec8f2b22e0b0b98fb5b4444ed451c1b21d125a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218391.

Do I need to act?

-
0.35% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
ADJACENT_NETWORK / LOW complexity

Affected Products (1)

Liftkit Database Library

Affected Vendors

Liftkit Database Library Project

References (8)

Patch https://github.com/liftkit/database/commit/42ec8f2b22e0b0b98fb5b4444ed451c1b21d1...
Release Notes https://github.com/liftkit/database/releases/tag/v2.13.2
Third Party Advisory https://vuldb.com/?ctiid.218391
Third Party Advisory https://vuldb.com/?id.218391
Patch https://github.com/liftkit/database/commit/42ec8f2b22e0b0b98fb5b4444ed451c1b21d1...
Release Notes https://github.com/liftkit/database/releases/tag/v2.13.2
Third Party Advisory https://vuldb.com/?ctiid.218391
Third Party Advisory https://vuldb.com/?id.218391
24
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal