| タイトル | GitHub house 6916d94 SQL Injection |
|---|
| 説明 | “House” is a house rental management system based on Spring MVC + MyBatis + MySQL. It includes two types of roles: landlords (administrators) and tenants, providing functions such as property management, contract signing, rent payment, and maintenance reporting.
Some MyBatis Mapper XML files in the system use ${} string concatenation instead of #{} parameterized queries, leading to SQL injection vulnerabilities in specific parameters. Since the system lacks any authentication interceptors, attackers can trigger the injection through specific interfaces without logging in, thereby obtaining all sensitive data from the database. |
|---|
| ソース | ⚠️ https://fanatical-brain-9ba.notion.site/house-SQL-injection-386f1a573df480ca80dfe7a5899c40bd |
|---|
| ユーザー | paramecium (UID 99013) |
|---|
| 送信 | 2026年06月21日 09:53 (4 月 ago) |
|---|
| モデレーション | 2026年08月06日 22:13 (2 months later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 386532 [chiuwingyan house 迄 dea6bcceaebe2b364a5a209747f48ecc2b2dc670 /paid/selectall.action zuname SQLインジェクション] |
|---|
| ポイント | 0 |
|---|