cve/2024/CVE-2024-21511.md

CVE-2024-21511

Description

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.

POC

Reference

• https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046
• https://security.snyk.io/vuln/SNYK-JS-MYSQL2-6670046

Github

• https://github.com/fkie-cad/nvd-json-data-feeds