Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-43608

CVE-2021-43608:
DBAL 3 SQL Injection Security Vulnerability

9.8

CVSS Score

Basic Information

CVE ID
CVE-2021-43608
GHSA ID
GHSA-r7cj-8hjg-x622
EPSS Score
-
CWE
CWE-89
Published
11/16/2021
Updated
2/6/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
doctrine/dbalcomposer>= 3.0.0, < 3.1.43.1.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability was explicitly fixed in AbstractPlatform::modifyLimitQuery by adding integer casting (commit 9dcfa4c). This method is the core handler for LIMIT clause generation, and the lack of input validation here directly enabled SQL injection. The CVE description and patch both specifically reference this method as the vulnerability source. The affected version range (3.0.0-3.1.3) matches the method's existence in those releases.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W* **v* r*l**s** * n*w v*rsion *o*trin* ***L *.*.* t**t *ix*s * *riti**l SQL inj**tion vuln*r**ility in t** LIMIT *l*us* **n*r*tion *PI provi*** *y t** Pl*t*orm **str**tion. W* **vis* *v*ryon* usin* *o*trin* ***L *.*.* up to *.*.* to up*r*** to *.*.

Reasoning

T** vuln*r**ility w*s *xpli*itly *ix** in **str**tPl*t*orm::mo*i*yLimitQu*ry *y ***in* int***r **stin* (*ommit *******). T*is m*t*o* is t** *or* **n*l*r *or LIMIT *l*us* **n*r*tion, *n* t** l**k o* input v*li**tion **r* *ir**tly *n**l** SQL inj**tion