chillzhuang/blade-tool · Security
SpringBlade vulnerable to SQL injection
- GHSA ID
- GHSA-62pr-54gv-vg5g
- CVE ID
- CVE-2023-40787
- Severity
- high
- Published
- Updated
Description
In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection.
CWEs
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')