CVE-2023-52290

In streampark-console the list pagese.g: application pages, users can sort page by field. This sort field is sent from the front-end to the back-end, and the SQL query is generated using this field. However, because this sort field isn't validated, there is a risk of SQL injection...

CVE-2023-52290

The streampark-console component (versions prior to 2.1.4 ) is vulnerable to SQL injection due to a lack of validation on the sort field sent from the front-end. Because the back-end uses this unvalidated field directly to generate SQL queries, an authenticated attacker can execute arbitrary quer...

CVE-2023-52290 Apache StreamPark (incubating): Unchecked SQL query fields trigger SQL injection vulnerability

In streampark-console the list pagese.g: application pages, users can sort page by field. This sort field is sent from the front-end to the back-end, and the SQL query is generated using this field. However, because this sort field isn't validated, there is a risk of SQL injection...

CVE-2023-52290 Apache StreamPark (incubating): Unchecked SQL query fields trigger SQL injection vulnerability

In streampark-console the list pagese.g: application pages, users can sort page by field. This sort field is sent from the front-end to the back-end, and the SQL query is generated using this field. However, because this sort field isn't validated, there is a risk of SQL injection...

CVE-2023-52290 Apache StreamPark (incubating): Unchecked SQL query fields trigger SQL injection vulnerability

In streampark-console the list pagese.g: application pages, users can sort page by field. This sort field is sent from the front-end to the back-end, and the SQL query is generated using this field. However, because this sort field isn't validated, there is a risk of SQL injection...

PT-2024-14507 · Unknown · Streampark-Console

Name of the Vulnerable Software and Affected Versions: streampark-console versions prior to 2.1.4 Description: The issue arises from the lack of validation of the sort field sent from the front-end to the back-end, which is used to generate SQL queries. This poses a risk of SQL injection,...

CVE-2023-52290: Improper Neutralization of Special Elements used in an SQL Command

In streampark-console the list pagese.g: application pages, users can sort page by field. This sort field is sent from the front-end to the back-end, and the SQL query is generated using this field. However, because this sort field isn't validated, there is a risk of SQL injection...

Apache StreamPark SQL注入漏洞

Apache StreamPark is the United States Apache Apache Foundation of a streaming media application development framework. Apache StreamPark suffers from a SQL injection vulnerability that can be exploited by an attacker to view, add, modify, or delete information in a back-end database...

PT-2023-9285 · Apache · Apache Streampark

Name of the Vulnerable Software and Affected Versions: Apache StreamPark versions prior to 2.1.4 Description: The issue is related to incorrect handling of the element in the Project Module of Apache StreamPark, allowing for remote command execution. The vulnerability can be exploited by insertin...

Apache StreamPark SQL Injection Vulnerability (CNVD-2024-0217486)

Apache StreamPark is the United States Apache Apache Foundation of a streaming media application development framework. Apache StreamPark suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. An attacker can exploit...

SQL Injection

org.apache.streampark, streampark is vulnerable to SQL Injection. The vulnerability is due to not sanitizing user input used inside a name-based fuzzy search e.g: job names, role names in some of the pages of the application. An attacker can use illegal parameters for the search leading to SQL...

Remote Code Execution

org.apache.streampark, streampark is vulnerable to Remote Code Execution. The vulnerability is caused due to a missing check on the compilation parameters of maven used in a project module that is used to integrate Maven's compilation capability. This can lead to an attacker inserting remote...

GHSA-QG44-XQWJ-WC28 Apache StreamPark: Authenticated system users could trigger remote command execution

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in...

GHSA-RRCG-JWR5-32G7 Apache StreamPark: Authenticated system users could trigger SQL injection vulnerability

In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role names, etc. The sql syntax :select from table where jobName like '%jobName%'. However, the jobName field may receive illegal parameters,...

Apache StreamPark: Authenticated system users could trigger remote command execution

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in...

Apache StreamPark: Authenticated system users could trigger SQL injection vulnerability

In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role names, etc. The sql syntax :select from table where jobName like '%jobName%'. However, the jobName field may receive illegal parameters,...

CVE-2023-30867

In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role names, etc. The sql syntax :select from table where jobName like '%jobName%'. However, the jobName field may receive illegal parameters,...

CVE-2023-49898

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in...

Sql injection

In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role names, etc. The sql syntax :select from table where jobName like '%jobName%'. However, the jobName field may receive illegal parameters,...

Input validation

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in...