CVE-2016-10550

Vulnerability

Sequelize, an ORM for Node.js, versions 3.16.0 and earlier, fails to properly escape user-provided values passed into the limit or order query parameters. If user input is directly supplied to these parameters without sanitization, an attacker can inject arbitrary SQL statements [1][2]. The vulnerability resides in the query generation logic where these arguments are concatenated into the final SQL without proper escaping [2].

Exploitation

An attacker needs to be able to influence the limit or order parameters of a Sequelize query, typically through unsanitized form fields, API inputs, or URL parameters. No special network position or authentication is required beyond the ability to interact with the application's database query interface. The attacker simply supplies crafted SQL strings within the limit or order values, which are then executed against the database [1].

Impact

Successful exploitation allows the attacker to perform SQL injection, potentially leading to unauthorized reading or modification of data, privilege escalation, or even remote code execution depending on the database configuration. The injected SQL runs with the database user's privileges owned by the application [1][3].

Mitigation

This vulnerability is fixed in Sequelize version 3.17.0 and later [3]. Users should upgrade to at least version 3.17.0. As a workaround, applications must ensure that user input is never passed directly to limit or order parameters and that these values are strictly validated and sanitized before use [1][2].