{"id":"GHSA-xc69-p8fc-m6m5","aliases":[],"status":"published","title":"silverstripe/subsites Unsafe SQL Query Construction (Safe Data Source)","description":"There is a low level potential SQL injection vulnerability in the silverstripe/subsites module has been identified and fixed in version 2.1.1.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2024-05-28T18:23:17Z","modified":"2024-12-03T06:16:52Z","fixes":[{"ecosystem":"Packagist","package":"silverstripe/subsites","fixed_in":["2.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"silverstripe/subsites","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"silverstripe/subsites","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.1"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.1.0"]}],"references":[{"url":"https://github.com/silverstripe/silverstripe-subsites/commit/bf2c81dce62ae9a7623d224fd31a39505260eb57","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/subsites/SS-2018-016-1.yaml","tags":["web"]},{"url":"https://www.silverstripe.org/download/security-releases/ss-2018-016","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xc69-p8fc-m6m5"},{"url":"https://github.com/silverstripe/silverstripe-subsites","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-xc69-p8fc-m6m5","title":"silverstripe/subsites Unsafe SQL Query Construction (Safe Data Source)","description":"There is a low level potential SQL injection vulnerability in the silverstripe/subsites module has been identified and fixed in version 2.1.1.\n\n","status":"published","published":"2024-05-28T18:23:17Z","modified":"2024-05-28T18:23:18Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:52.2286Z"}],"osv":[{"id":"GHSA-xc69-p8fc-m6m5","title":"silverstripe/subsites Unsafe SQL Query Construction (Safe Data Source)","description":"There is a low level potential SQL injection vulnerability in the silverstripe/subsites module has been identified and fixed in version 2.1.1.\n\n","status":"published","published":"2024-05-28T18:23:17Z","modified":"2024-12-03T06:16:52.341381Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:59.835583Z"}]}}