CVE-2026-111613
CVE-2026-111613 · AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with allowLoadLocalInfile=true pointing to an attacker-controlled server to read arbitrary files from the data-dts host.
CVSS 8.7 · Hoch · EPSS 0,6%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
alldata
- Softwareversionen
- ≥ 0, ≤ 0.7.1: Betroffen (custom)
Keine Korrektur veröffentlicht
Originalquellen
- https://hackmd.io/@hieuPenguinnn/alldata-dts-unauthenticated-jdbc-url-injection
- https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/tool/query/BaseQueryTool.java#L107-L124
- https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/config/WebSecurityConfiguration.java
- https://github.com/alldatacenter/alldata/blob/alldata-release-0.7.1/moat/studio/data-dts/service-data-dts/src/main/java/com/platform/admin/controller/JobDatasourceController.java#L131-L135
- https://github.com/alldatacenter/alldata
- https://www.vulncheck.com/advisories/alldata-through-0.7.1-unauthenticated-jdbc-injection-via-jobjdbcdatasource-test
- https://nvd.nist.gov/vuln/detail/CVE-2026-111613