| 标题 | dromara dataCompare 1.0.1 Improper Input Validation |
|---|
| 描述 | The DbConfig does not validate or sanitize the JDBC URL. An attacker can inject dangerous connection parameters such as allowLoadLocalInfile, allowUrlInLocalInfile, and autoDeserialize into the JDBC URL. When the connection test is performed in DbconfigServiceImpl, these properties are activated, potentially leading to arbitrary file read, SSRF, or deserialization-based remote code execution. |
|---|
| 来源 | ⚠️ https://github.com/dromara/dataCompare/issues/13 |
|---|
| 用户 | R1ckyZ (UID 92331) |
|---|
| 提交 | 2025-11-05 09時34分 (9 月前) |
|---|
| 管理 | 2025-11-16 16時44分 (11 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 332603 [Dromara dataCompare 直到 1.0.1 JDBC URL DbconfigServiceImpl.java DbConfig 权限提升] |
|---|
| 积分 | 19 |
|---|