Description
Sylius is an Open Source eCommerce Framework on Symfony. Sylius API filters ProductPriceOrderFilter and TranslationOrderNameAndLocaleFilter pass user-supplied order direction values directly to Doctrine's orderBy() without validation. An attacker can inject arbitrary DQL. The issue is fixed in versions: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, 2.2.3 and above.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Sylius Sylius
>= 2.2.0, < 2.2.3affected>= 2.1.0, < 2.1.12affected>= 2.0.0, < 2.0.16affected>= 1.14.0, < 1.14.18affected>= 1.13.0, < 1.13.15affected>= 1.12.0, < 1.12.23affected>= 1.11.0, < 1.11.17affected>= 1.10.0, < 1.10.16affected< 1.9.12affected