| शीर्षक | liyupi yu-picture <= 0.0.1-SNAPSHOT SQL Injection |
|---|
| विवरण | yu-picture is an enterprise-level image sharing platform based on Vue 3 + Spring Boot + MyBatis-Plus. Multiple pagination query endpoints (POST /api/picture/list/page/vo, POST /api/space/list/page/vo) are accessible without authentication and accept a user-controlled sortField parameter that is directly concatenated into the SQL ORDER BY clause via MyBatis-Plus orderBy() method without any validation or parameterization. An unauthenticated remote attacker can exploit this time-based blind SQL injection to extract arbitrary data from the database, including user credentials and admin passwords. The vulnerability exists in PictureServiceImpl.java (L336), SpaceServiceImpl.java (L224), and UserServiceImpl.java (L240), all sharing the same vulnerable pattern in the PageRequest base class. |
|---|
| स्रोत | ⚠️ https://github.com/liyupi/yu-picture/issues/4 |
|---|
| उपयोगकर्ता | anch0r (UID 96691) |
|---|
| सबमिशन | 07/04/2026 10:29 AM (21 दिन पहले) |
|---|
| संयम | 26/04/2026 03:19 AM (19 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 359633 [liyupi yu-picture तक a053632c41340152bf75b66b3c543d129123d8ec MyBatis-Plus PictureServiceImpl.java PageRequest sortField SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|