제출 #782969: AutohomeCorp frostmourne <= 1.0 SQL Injection정보

제목AutohomeCorp frostmourne <= 1.0 SQL Injection
설명Frostmourne Monitor contains a MySQL dynamic SQL injection vulnerability in the alarm preview/query flow. The metricContract.queryString value is treated as trusted SQL and is directly concatenated into backend queries without parameterization or whitelist validation. An authenticated attacker who can access the alarm preview functionality can first enumerate an available MySQL data name and then supply arbitrary SQL expressions that are executed by the server against the corresponding MySQL data source.
원천⚠️ https://fx4tqqfvdw4.feishu.cn/docx/M0u0dPZmZosY9Ax6OsScJ3Blnxf?from=from_copylink
사용자
 xcxr (UID 86629)
제출2026. 03. 19. PM 01:15 (28 날 ago)
모더레이션2026. 04. 04. PM 04:09 (16 days later)
상태수락
VulDB 항목355333 [AutohomeCorp frostmourne 까지 1.0 Alarm Preview previewData httpTest SQL 주입]
포인트들20

◂ 이전개요다음 ▸

Interested in the pricing of exploits?

See the underground prices here!