漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
SQL injection in jackalope/jackalope-doctrine-dbal
Vulnerability Description
Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWalker`: `XPath::escape($property)`. Node names and xpaths can contain `"` or `;` according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain `;`, you are not affected.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Vulnerability Title
Jackalope Doctrine-DBAL SQL注入漏洞
Vulnerability Description
Jackalope Doctrine-DBAL是使用关系数据库来持久化数据的 PHP 内容存储库 API ( PHPCR ) 的实现。 Jackalope Doctrine-DBAL存在SQL注入漏洞，该漏洞源于软件对于$property参数缺少有效的过滤。在受影响的版本中，如果用户可以指定一个节点名或查询，就可以触发SQL注入。
CVSS Information
N/A
Vulnerability Type
N/A