| عنوان | GitHub house V1.0 SQL Injection |
|---|
| الوصف | “House” is a house rental management system based on Spring MVC + MyBatis + MySQL. It includes two types of roles: landlords (administrators) and tenants, providing functions such as property management, contract signing, rent payment, and maintenance reporting.
Some MyBatis Mapper XML files in the system use ${} string concatenation instead of #{} parameterized queries, leading to SQL injection vulnerabilities in specific parameters. Since the system lacks any authentication interceptors, attackers can trigger the injection through specific interfaces without logging in, thereby obtaining all sensitive data from the database. |
|---|
| المصدر | ⚠️ https://fanatical-brain-9ba.notion.site/house-383f1a573df4808a87dbe70b85afce52 |
|---|
| المستخدم | paramecium (UID 99013) |
|---|
| ارسال | 20/06/2026 06:56 AM (2 أشهر منذ) |
|---|
| الاعتدال | 06/08/2026 10:31 AM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 386532 [chiuwingyan house حتى dea6bcceaebe2b364a5a209747f48ecc2b2dc670 /paid/selectall.action zuname حقن SQL] |
|---|
| النقاط | 17 |
|---|