| शीर्षक | dromara dataCompare 1.0.1 Improper Input Validation |
|---|
| विवरण | The DbConfig does not validate or sanitize the JDBC URL. An attacker can inject dangerous connection parameters such as allowLoadLocalInfile, allowUrlInLocalInfile, and autoDeserialize into the JDBC URL. When the connection test is performed in DbconfigServiceImpl, these properties are activated, potentially leading to arbitrary file read, SSRF, or deserialization-based remote code execution. |
|---|
| स्रोत | ⚠️ https://github.com/dromara/dataCompare/issues/13 |
|---|
| उपयोगकर्ता | R1ckyZ (UID 92331) |
|---|
| सबमिशन | 05/11/2025 09:34 AM (9 महीनों पहले) |
|---|
| संयम | 16/11/2025 04:44 PM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 332603 [Dromara dataCompare तक 1.0.1 JDBC URL DbconfigServiceImpl.java DbConfig अधिकार वृद्धि] |
|---|
| अंक | 19 |
|---|