Threats tagged 'ghsa-24q3-fp2q-x646'

SQL::Abstract versions from 1.90_01 up to but not including 2.000001_04 for Perl contain a vulnerability that allows SQL injection via the where values of a nested statement used in identifier positions. This occurs because nested statements treat their own plain scalars as identifiers in certain SQL clauses, causing unescaped input to be inserted directly into the SQL text instead of being safely bound. Applications passing untrusted input in these contexts may be vulnerable to injection attacks.