x/vulndb: potential Go vuln in github.com/flipped-aurora/gin-vue-admin: CVE-2024-37896

[GoVulnBot]

Advisory CVE-2024-37896 references a vulnerability in the following Go modules:

Module
github.com/flipped-aurora/gin-vue-admin

Description:
Gin-vue-admin is a backstage management system based on vue and gin.
Gin-vue-admin <= v2.6.5 has SQL injection vulnerability. The SQL injection
vulnerabilities occur when a web application allows users to input data into SQL
queries without sufficiently validating or sanitizing the input. Failing to
properly enforce restrictions on user input could mean that even a basic form
input field can be used to inject arbitrary and potentially dangerous SQL
commands. This could lead to unauthorized access to the database, data leakage,
data manipulation, or even complete compromise of the database serv...

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-37896
• FIX: flipped-aurora/gin-vue-admin@53d0338
• WEB: GHSA-gf3r-h744-mqgp

Cross references:

• Module github.com/flipped-aurora/gin-vue-admin appears in issue x/vulndb: potential Go vuln in github.com/flipped-aurora/gin-vue-admin: CVE-2022-39305 #1076 EFFECTIVELY_PRIVATE
• Module github.com/flipped-aurora/gin-vue-admin appears in issue x/vulndb: potential Go vuln in github.com/flipped-aurora/gin-vue-admin: CVE-2022-39345 #1082 EFFECTIVELY_PRIVATE
• Module github.com/flipped-aurora/gin-vue-admin appears in issue x/vulndb: potential Go vuln in github.com/flipped-aurora/gin-vue-admin: GHSA-x623-hr8h-7g5v #1560 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/flipped-aurora/gin-vue-admin
      vulnerable_at: 2.6.6+incompatible
      packages:
        - package: gin-vue-admin
summary: CVE-2024-37896 in github.com/flipped-aurora/gin-vue-admin
cves:
    - CVE-2024-37896
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-37896
    - fix: https://github.com/flipped-aurora/gin-vue-admin/commit/53d03382188868464ade489ab0713b54392d227f
    - web: https://github.com/flipped-aurora/gin-vue-admin/security/advisories/GHSA-gf3r-h744-mqgp
source:
    id: CVE-2024-37896
    created: 2024-06-17T21:01:16.254987376Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/594901 mentions this issue: data/reports: add 18 unreviewed reports

[gopherbot]

Change https://go.dev/cl/595636 mentions this issue: data/reports: add 15 unreviewed reports