Miggo Logo
Miggo Vulnerability Database
→
CVE-2016-15020

CVE-2016-15020: SQL Injection in liftkit/database

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2016-15020
GHSA ID
GHSA-8hcf-2m4v-f2rq
EPSS Score
0.1644%
CWE
CWE-89
Published
1/16/2023
Updated
10/20/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
liftkit/databasecomposer< 2.13.22.13.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from how processOrderBy() handled the 'direction' parameter in ORDER BY clauses. The pre-patch code (line 1067 in diff) directly used $orderBy['direction'] from user input. Attackers could supply malicious SQL operators instead of valid ASC/DESC directions. The patch adds validation by comparing against class constants (QUERY_ORDER_ASC/DESC), demonstrating the original lack of input filtering. The CWE-89 classification and commit message explicitly confirm this SQL injection vector in the orderBy handling.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility w*s *oun* in li*tkit **t***s* up to *.**.*. It **s ***n *l*ssi*i** *s *riti**l. T*is *****ts t** *un*tion pro**ssOr**r*y o* t** *il* sr*/Qu*ry/Qu*ry.p*p. T** m*nipul*tion l***s to sql inj**tion. Up*r**in* to v*rsion *.**.* is **l* to

Reasoning

T** vuln*r**ility st*ms *rom *ow pro**ssOr**r*y() **n*l** t** '*ir**tion' p*r*m*t*r in OR**R *Y *l*us*s. T** pr*-p*t** *o** (lin* **** in *i**) *ir**tly us** $or**r*y['*ir**tion'] *rom us*r input. *tt**k*rs *oul* supply m*li*ious SQL op*r*tors inst**