| शीर्षक | AutohomeCorp frostmourne <= 1.0 SQL Injection |
|---|
| विवरण | Frostmourne Monitor contains a MySQL dynamic SQL injection vulnerability in the alarm preview/query flow. The metricContract.queryString value is treated as trusted SQL and is directly concatenated into backend queries without parameterization or whitelist validation. An authenticated attacker who can access the alarm preview functionality can first enumerate an available MySQL data name and then supply arbitrary SQL expressions that are executed by the server against the corresponding MySQL data source. |
|---|
| स्रोत | ⚠️ https://fx4tqqfvdw4.feishu.cn/docx/M0u0dPZmZosY9Ax6OsScJ3Blnxf?from=from_copylink |
|---|
| उपयोगकर्ता | xcxr (UID 86629) |
|---|
| सबमिशन | 19/03/2026 01:15 PM (7 महीनों पहले) |
|---|
| संयम | 04/04/2026 04:09 PM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 355333 [AutohomeCorp frostmourne तक 1.0 Alarm Preview previewData httpTest SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|