Submit #105885: Novel-Plus 3.6.2 NewsController list action exists sqli
| Title | Novel-Plus 3.6.2 NewsController list action exists sqli |
|---|---|
| Description | The vulnerability was found in the backend, and during the white-box audit, it was discovered that the backend password was weak by default, and the cause was the inability to pre-compile the orderby field using mybatis, and no filtering was done There is a list method under the news controller in the novel module, which does not have any processing of the parameters to go to the next step in the process, |
| Source | ⚠️ https:/ |
| User | Morty (ID 43740) |
| Submission | 03/26/2023 04:29 (1 Year ago) |
| Moderation | 04/14/2023 08:32 (19 days later) |
| Accepted | Duplicate |
| VulDB Entry | VDB-225918 |