Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

dotnetnext/sqlsugar

              master @ 09815eb
            

Fixes

CVEs

HIGH

Peak severity

66.7%

Coverage

Highlights

Injection: 1 prior fix. Scrutinize any change in this area.

MongoDb.Ado.data: most-fixed (2 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

NoSQL Injection: Insecure handling of dynamic operations in MongoDB's ADO data layer allowed arbitrary database operations. If new commands are introduced to the ADO provider without validation, attackers can run arbitrary database administrative queries.

Injection: The query dispatch handler executed raw/dynamic operations directly. Restricting handlers to an explicit dictionary-based allowlist was required to prevent arbitrary remote injection.

SQL Injection: DbMaintenanceProvider generated dynamic SQL containing table and column names directly into structural commands. Unescaped column metadata manipulated by upstream interfaces can lead to complete SQL execution control.