CVE:CVE-2023-22578
CNNVD:CNNVD-202302-1372
feathers-sequelize是Feathers Ecosystem开源的一个用于 Sequelize 的 Feathers 数据库适配器。
feathersjs-ecosystem/feathers-sequelize存在安全漏洞，该漏洞源于属性过滤不当，攻击者利用该漏洞可以进行SQL注入。
solution:Upgrade sequelizejs sequelize to a higher version than 6.29.0,7.0.0:alpha1,7.0.0:alpha10,7.0.0:alpha11,7.0.0:alpha12,7.0.0:alpha13,7.0.0:alpha14,7.0.0:alpha15,7.0.0:alpha16,7.0.0:alpha17,7.0.0:alpha18,7.0.0:alpha19,7.0.0:alpha2,7.0.0:alpha2.1,7.0.0:alpha2.2,7.0.0:alpha3,7.0.0:alpha4,7.0.0:alpha5,7.0.0:alpha6,7.0.0:alpha7,7.0.0:alpha8,7.0.0:alpha9,7.0.0:oc_test_1,7.0.0:oc_test_2,7.0.0:oc_test_3,7.0.0:oc_test_4,and avoid the version (,6.29.0),7.0.0:alpha1,7.0.0:alpha10,7.0.0:alpha11,7.0.0:alpha12,7.0.0:alpha13,7.0.0:alpha14,7.0.0:alpha15,7.0.0:alpha16,7.0.0:alpha17,7.0.0:alpha18,7.0.0:alpha19,7.0.0:alpha2,7.0.0:alpha2.1,7.0.0:alpha2.2,7.0.0:alpha3,7.0.0:alpha4,7.0.0:alpha5,7.0.0:alpha6,7.0.0:alpha7,7.0.0:alpha8,7.0.0:alpha9,7.0.0:oc_test_1,7.0.0:oc_test_2,7.0.0:oc_test_3,7.0.0:oc_test_4