{"id":"CVE-2015-1369","aliases":["EUVD-2017-0332","GHSA-xqg8-cv3h-xppv"],"status":"published","title":"SQL Injection in sequelize","description":"SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02115,"percentile":0.81953,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2015-01-27T17:00:00Z","modified":"2026-06-17T00:22:16Z","fixes":[{"ecosystem":"npm","package":"sequelize","fixed_in":["2.0.0-rc8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"sequelize","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.0.0-rc7"},{"fixed":"2.0.0-rc8"}]}]},{"source":"osv","ecosystem":"npm","package":"sequelize","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.0-rc8"}]}]}],"products":[{"vendor":"sequelize_project","product":"sequelize"}],"references":[{"url":"https://github.com/sequelize/sequelize/pull/2919","tags":["x_refsource_CONFIRM","x_transferred","Exploit","web"]},{"url":"https://nodesecurity.io/advisories/sequelize-sql-injection-order","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"http://www.openwall.com/lists/oss-security/2015/01/23/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1369","tags":["advisory"]},{"url":"https://github.com/sequelize/sequelize/issues/2906","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xqg8-cv3h-xppv","tags":["advisory"]},{"url":"https://www.npmjs.com/advisories/33","tags":["web"]},{"url":"https://github.com/sequelize/sequelize","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2015-1369","description":"SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter.","status":"published","published":"2015-01-27T17:00:00Z","modified":"2024-08-06T04:40:18.703Z","updated_at":"2026-11-02T14:35:44.046042Z"}],"euvd":[{"id":"EUVD-2017-0332","description":"SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter.","status":"published","published":"2015-01-27T17:00:00Z","modified":"2024-08-06T04:40:18Z","updated_at":"2026-11-03T02:22:15.605684Z"}],"ghsa":[{"id":"GHSA-xqg8-cv3h-xppv","title":"SQL Injection in sequelize","description":"Versions 2.0.0-rc-7 and earlier of `sequelize` are affected by a SQL injection vulnerability when user input is passed into the order parameter.\n\n\n\n## Proof of Concept\n\n```javascript\nTest.findAndCountAll({\nwhere: { id :1 },\norder : [['id', 'UNTRUSTED USER INPUT']]\n})\n```\n\n\n## Recommendation\n\nUpdate to version 2.0.0-rc8 or later","status":"published","published":"2017-10-24T18:33:36Z","modified":"2023-01-09T05:03:29Z","cwes":["CWE-89"],"updated_at":"2026-11-02T14:36:05.071174Z"}],"nvd":[{"id":"CVE-2015-1369","description":"SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js allows remote attackers to execute arbitrary SQL commands via the order parameter.","status":"published","published":"2015-01-27T20:04:26.557Z","modified":"2026-06-17T00:22:16.97Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:03:01.643178Z"}],"osv":[{"id":"GHSA-xqg8-cv3h-xppv","title":"SQL Injection in sequelize","description":"Versions 2.0.0-rc-7 and earlier of `sequelize` are affected by a SQL injection vulnerability when user input is passed into the order parameter.\n\n\n\n## Proof of Concept\n\n```javascript\nTest.findAndCountAll({\nwhere: { id :1 },\norder : [['id', 'UNTRUSTED USER INPUT']]\n})\n```\n\n\n## Recommendation\n\nUpdate to version 2.0.0-rc8 or later","status":"published","published":"2017-10-24T18:33:36Z","modified":"2023-11-08T03:57:49.769609Z","cwes":["CWE-89"],"updated_at":"2026-11-02T15:47:00.198893Z"}]}}