SQL Injection in sequelize (GHSA-xqg8-cv3h-xppv)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2015-1369
Severity: HIGH · CWE: CWE-89

Versions 2.0.0-rc-7 and earlier of `sequelize` are affected by a SQL injection vulnerability when user input is passed into the order parameter.



## Proof of Concept

```javascript
Test.findAndCountAll({
where: { id :1 },
order : [['id', 'UNTRUSTED USER INPUT']]
})
```


## Recommendation

Update to version 2.0.0-rc8 or later

Affected packages:
package: ecosystem: npm
name: sequelize
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.0.0-rc8
database_specific: last_known_affected_version_range: <= 2.0.0-rc7