| शीर्षक | Tiandy Technologies Co., Ltd. Integrated Management Platform 7.17.0 SQL Injection |
|---|
| विवरण | The system is vulnerable to an Unauthenticated SQL Injection within the getAuthorityByUserId authorization endpoint. An attacker can inject malicious SQL commands via the userId parameters without any prior login. It has been verified that this flaw allows the extraction of database user information (e.g., current_user). Given that this vulnerability exists within a core authorization module, it could be further exploited to bypass access control mechanisms and retrieve administrative credentials. This unauthorized access to sensitive data poses a severe threat to the system's confidentiality and integrity. |
|---|
| स्रोत | ⚠️ https://my.feishu.cn/docx/UxbzdoU7coxKGjxbJ7ycPor3n3Q?from=from_copylink |
|---|
| उपयोगकर्ता | 0menc (UID 75423) |
|---|
| सबमिशन | 04/03/2026 08:51 AM (7 महीनों पहले) |
|---|
| संयम | 15/03/2026 07:46 PM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 351155 [Tiandy Integrated Management Platform 7.17.0 getAuthorityByUserId userId SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|