cve/2024/CVE-2024-21508.md

CVE-2024-21508

Description

Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.

POC

Reference

• https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085
• https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6591085

Github

• https://github.com/Geniorio01/CVE-2024-21508-mysql2-RCE
• https://github.com/nomi-sec/PoC-in-GitHub