Description

In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection.

Remediation

References

https://gist.github.com/kaliwin/9d6cf58bb6ec06765cdf7b75e13ee460

https://sword.bladex.cn/

Related Vulnerabilities

CVE-2022-35980 Vulnerability in maven package org.opensearch.plugin:opensearch-security

CVE-2021-32822 Vulnerability in npm package hbs

CVE-2023-1436 Vulnerability in maven package org.codehaus.jettison:jettison

CVE-2023-31581 Vulnerability in maven package com.usthe.sureness:sureness-core

CVE-2017-16010 Vulnerability in npm package i18next

Severity

Critical

Classification

CWE-89 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory Permissions Required