提交 #646886: kuaifan DooTask <= 1.2.49 SQL Injection

There is a SQL injection vulnerability in dootask versions less than or equal to 1.2.49. Any logged-in user can inject SQL through the keys[department] parameter of /api/users/lists.

• 来源: ⚠️ https://github.com/kuaifan/dootask/issues/283
• 用户: A_Groundhog (UID 89054)
• 提交: 2025-09-03 12時04分 (1 年前)
• 管理: 2025-09-20 09時07分 (17 days later)
• 状态: 已接受
• VulDB条目: 325117 [kuaifan DooTask 直到 1.2.49 UsersController.php keys[department] SQL注入]
• 积分: 16