| عنوان | dromara dataCompare 1.0.1 Improper Input Validation |
|---|
| الوصف | The DbConfig does not validate or sanitize the JDBC URL. An attacker can inject dangerous connection parameters such as allowLoadLocalInfile, allowUrlInLocalInfile, and autoDeserialize into the JDBC URL. When the connection test is performed in DbconfigServiceImpl, these properties are activated, potentially leading to arbitrary file read, SSRF, or deserialization-based remote code execution. |
|---|
| المصدر | ⚠️ https://github.com/dromara/dataCompare/issues/13 |
|---|
| المستخدم | R1ckyZ (UID 92331) |
|---|
| ارسال | 05/11/2025 09:34 AM (9 أشهر منذ) |
|---|
| الاعتدال | 16/11/2025 04:44 PM (11 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 332603 [Dromara dataCompare حتى 1.0.1 JDBC URL DbconfigServiceImpl.java DbConfig تجاوز الصلاحيات] |
|---|
| النقاط | 19 |
|---|