Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
taffydb npm module, vulnerable in all versions up to and including 2.7.3, allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. taffy sets an internal index for each data item in its DB. However, it is found that the internal index can be forged by adding additional properties into user-input. If index is found in the query, taffyDB will ignore other query conditions and directly return the indexed data item. Moreover, the internal index is in an easily-guessable format (e.g., T000002R000001). As such, attackers can use this vulnerability to access any data items in the DB.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Taffy 输入验证错误漏洞
Vulnerability Description
Taffy是一款数据选择引擎，它支持插入、更新和统计数据等功能。 Taffy 2.6.2及之前版本中存在输入验证错误漏洞。攻击者可借助带有多余属性的用户输入利用该漏洞访问DB中的任意数据条目。
CVSS Information
N/A
Vulnerability Type
N/A