| Название | dromara dataCompare 1.0.1 Improper Input Validation |
|---|
| Описание | The DbConfig does not validate or sanitize the JDBC URL. An attacker can inject dangerous connection parameters such as allowLoadLocalInfile, allowUrlInLocalInfile, and autoDeserialize into the JDBC URL. When the connection test is performed in DbconfigServiceImpl, these properties are activated, potentially leading to arbitrary file read, SSRF, or deserialization-based remote code execution. |
|---|
| Источник | ⚠️ https://github.com/dromara/dataCompare/issues/13 |
|---|
| Пользователь | R1ckyZ (UID 92331) |
|---|
| Представление | 05.11.2025 09:34 (9 месяцы назад) |
|---|
| Модерация | 16.11.2025 16:44 (11 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 332603 [Dromara dataCompare до 1.0.1 JDBC URL DbconfigServiceImpl.java DbConfig эскалация привилегий] |
|---|
| Баллы | 19 |
|---|