提出 #782969: AutohomeCorp frostmourne <= 1.0 SQL Injection情報

タイトルAutohomeCorp frostmourne <= 1.0 SQL Injection
説明Frostmourne Monitor contains a MySQL dynamic SQL injection vulnerability in the alarm preview/query flow. The metricContract.queryString value is treated as trusted SQL and is directly concatenated into backend queries without parameterization or whitelist validation. An authenticated attacker who can access the alarm preview functionality can first enumerate an available MySQL data name and then supply arbitrary SQL expressions that are executed by the server against the corresponding MySQL data source.
ソース⚠️ https://fx4tqqfvdw4.feishu.cn/docx/M0u0dPZmZosY9Ax6OsScJ3Blnxf?from=from_copylink
ユーザー
 xcxr (UID 86629)
送信2026年03月19日 13:15 (18 日 ago)
モデレーション2026年04月04日 16:09 (16 days later)
ステータス承諾済み
VulDBエントリ355333 [AutohomeCorp frostmourne 迄 1.0 Alarm Preview previewData httpTest SQLインジェクション]
ポイント20

◂ 前概要次 ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!