Preface Hi, I’m stypr (@stereotype32 ) from Flatt Security Inc. Last year, I wrote a blog post about technical explanations about 0days found in Japanese OSS products. I have found a lot of vulnerabilities in various products since then. Unfortunately, most bugs I found did not get it fixed right away…

TL;DR It was found that unexpected behaviors in the query’s escape function could cause a SQL injection in mysqljs/mysql (https://github.com/mysqljs/mysql), which is one of the most popular MySQL packages in the Node.js ecosystem. Typically, query escape functions or placeholders are known to prevent SQL injections. However, mysqljs/mysql is known to have…

Note) It’s just an English version of previous post. Hello, I’m Shiga( @Ga_ryo_ ), a security engineer at Flatt Security Inc. In this article, I would like to give you a technical description of CVE-2020–15702 which is published recently. I discovered this vulnerability and reported it to the vendor via…