CVE-2024-44905: go-pg SQL injection vulnerability via the component /types/append_value.go

[ramgopalk97]

Currently go-pg/pg package contains a SQL injection vulnerability in the component /types/append_value.go.

pg/types/append_value.go

Line 151 in 30e7053

return strconv.AppendInt(b, v.Int(), 10)

The vulnerability allows an attacker to inject SQL queries by manipulating line comments in PostgreSQL. When running in simple query mode, the library incorrectly handles parameter values that can create SQL line comments (--), potentially allowing syntax modification of the original query.

More details: https://www.sonarsource.com/blog/double-dash-double-trouble-a-subtle-sql-injection-flaw/