GHSA-xx4r-5265-48j6
silverstripe/framework SQL injection in full text search
GHSA-xx4r-5265-48j6 is a high vulnerability (CVSS 8.8) in silverstripe/framework, published May 27, 2024. No source lists public exploit code. Fixed in silverstripe/framework 3.5.6.
- Severity
- 8.8 HighCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.5.6silverstripe/framework +5 more
Description
When performing a fulltext search in SilverStripe 4.0.0 the 'start' querystring parameter is never escaped safely. This exposes a possible SQL injection vulnerability.
The issue exists in 3.5 and 3.6 but is less vulnerable, as SearchForm sanitises these variables prior to passing to mysql.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/frameworkPackagist | 3.5.0-rc1 up to 3.5.6 | 3.5.6 |
silverstripe/frameworkPackagist | 3.6.0-rc1 up to 3.6.3 | 3.6.3 |
silverstripe/frameworkPackagist | 4.0.0-rc1 up to 4.0.1 | 4.0.1 |
silverstripe/frameworkPackagist | 3.5.0-rc1 up to 3.5.6, plus listed versions 3.5.03.5.0-rc23.5.0-rc33.5.13.5.1-rc1 Show 11 moreShow less3.5.1-rc23.5.23.5.2-rc13.5.33.5.3-rc13.5.43.5.4-rc13.5.53.5.5-beta13.5.5-beta23.5.6-rc1 | 3.5.6 |
silverstripe/frameworkPackagist | 3.6.0-rc1 up to 3.6.3, plus listed versions 3.6.03.6.13.6.1-alpha23.6.23.6.2-beta13.6.2-beta23.6.3-rc2 | 3.6.3 |
silverstripe/frameworkPackagist | 4.0.0-rc1 up to 4.0.1, plus listed versions 4.0.04.0.0-rc24.0.0-rc34.0.1-rc1 | 4.0.1 |
What each source reports
GitHub Advisories Score used
silverstripe/framework SQL injection in full text search
When performing a fulltext search in SilverStripe 4.0.0 the 'start' querystring parameter is never escaped safely. This exposes a possible SQL injection vulnerability.
The issue exists in 3.5 and 3.6 but is less vulnerable, as SearchForm sanitises these variables prior to passing to mysql.
- Record
GHSA-xx4r-5265-48j6- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
silverstripe/framework SQL injection in full text search
When performing a fulltext search in SilverStripe 4.0.0 the 'start' querystring parameter is never escaped safely. This exposes a possible SQL injection vulnerability.
The issue exists in 3.5 and 3.6 but is less vulnerable, as SearchForm sanitises these variables prior to passing to mysql.
- Record
GHSA-xx4r-5265-48j6- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/silverstripe/silverstripe-framework/commit/099a5a3c2d99ed39bdd8815e1e2790bb9351770b
silverstripe.org/download/security-releases/ss-2017-008