GHSA-62pr-54gv-vg5g

SpringBlade vulnerable to SQL injection

At a glance

Published: 2023-08-29 15:31 UTC
Updated: 2023-11-08 04:13 UTC
CVE: CVE-2023-40787

Description

In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection.

Affected packages

Package	Versions
Maven · org.springblade:blade-core-tool	3.6.0

References

https://nvd.nist.gov/vuln/detail/CVE-2023-40787 ADVISORY
https://gist.github.com/kaliwin/9d6cf58bb6ec06765cdf7b75e13ee460 WEB
https://github.com/chillzhuang/blade-tool PACKAGE
https://sword.bladex.cn WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database