| 제목 | dromara dataCompare 1.0.1 Improper Input Validation |
|---|
| 설명 | The DbConfig does not validate or sanitize the JDBC URL. An attacker can inject dangerous connection parameters such as allowLoadLocalInfile, allowUrlInLocalInfile, and autoDeserialize into the JDBC URL. When the connection test is performed in DbconfigServiceImpl, these properties are activated, potentially leading to arbitrary file read, SSRF, or deserialization-based remote code execution. |
|---|
| 원천 | ⚠️ https://github.com/dromara/dataCompare/issues/13 |
|---|
| 사용자 | R1ckyZ (UID 92331) |
|---|
| 제출 | 2025. 11. 05. AM 09:34 (9 개월 ago) |
|---|
| 모더레이션 | 2025. 11. 16. PM 04:44 (11 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 332603 [Dromara dataCompare 까지 1.0.1 JDBC URL DbconfigServiceImpl.java DbConfig 권한 상승] |
|---|
| 포인트들 | 19 |
|---|