| शीर्षक | risesoft-y9 Digital-Infrastructure <=9.6.7 SQL Injection |
|---|
| विवरण | In the latest version (<=9.6.7), a parameter passed to the endpoint /server-platform/services/rest/auth/authenticate3 are user-controllable and not sanitized, and no prepared statements are used when executing the final SQL query, resulting in a SQL injection vulnerability. Attackers can exploit this vulnerability to obtain sensitive data from the database and even gain complete control of the server.
the vulnerability is also affecting to the endpoints (same sink):
/server-platform/services/rest/auth/authenticate5
/server-platform/services/rest/v1/auth/authenticate3 |
|---|
| स्रोत | ⚠️ https://github.com/risesoft-y9/Digital-Infrastructure/issues/2 |
|---|
| उपयोगकर्ता | ZAST.AI (UID 87884) |
|---|
| सबमिशन | 03/01/2026 10:05 AM (9 महीनों पहले) |
|---|
| संयम | 16/01/2026 05:43 PM (13 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 341603 [risesoft-y9 Digital-Infrastructure तक 9.6.7 REST Authenticate Endpoint Y9PlatformUtil.java SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|