Threats tagged 'ghsa-qqg5-vxjp-68gf'

SQLite versions before 3.54.0 have an authorization bypass vulnerability in the lookupName() function. This flaw causes the authorizer callback to be invoked only for the first joined table's USING column, allowing attackers who can submit SQL queries to read columns that should be restricted by SQLITE_READ authorizer rules when using RIGHT or FULL JOINs on shared USING columns.