| शीर्षक | PowerJob PowerJob ≤ 5.1.2 SQL Injection |
|---|
| विवरण | A vulnerability has been identified in PowerJob up to v5.1.2, specifically within the container management module. The issue exists in the downloadJar endpoint of the ContainerController class. When the application is configured to use MySQL-based Distributed File System (DFS) storage (oms.storage.dfs.active=mysql_series), the version parameter is passed directly to the underlying persistence layer without adequate sanitization or parameterized querying. The root cause is located in the fetchFileMeta method of the MySqlSeriesDfsService class, where the user-supplied version string is concatenated into a SQL query. This allows an unauthenticated remote attacker to inject malicious SQL commands. |
|---|
| स्रोत | ⚠️ https://fx4tqqfvdw4.feishu.cn/docx/Pxzxd3YSPo1jmwxBksAcztG2nte |
|---|
| उपयोगकर्ता | xcxr (UID 86629) |
|---|
| सबमिशन | 03/02/2026 10:18 AM (8 महीनों पहले) |
|---|
| संयम | 15/02/2026 08:32 PM (12 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 283927 [Powerjob 3.20 version SQL इंजेक्शन] |
|---|
| अंक | 0 |
|---|