HIGH7.5

PYSEC-2022-43189

Quick fix

PYSEC-2022-43189 — casdoor: upgrade to the fixed version with the command below.

pip install --upgrade 'casdoor>=1.13.1'

Details

The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/casdoor

Introduced in: 0Fixed in: 1.13.1

Fixpip install --upgrade 'casdoor>=1.13.1'

References

https://github.com/casdoor/casdoor/compare/v1.13.0...v1.13.1[ADVISORY]
https://github.com/casdoor/casdoor/issues/439[FIX]
https://github.com/casdoor/casdoor/pull/442[FIX]
http://packetstormsecurity.com/files/166163/Casdoor-1.13.0-SQL-Injection.html[EVIDENCE]