CVE-2023-52290

The streampark-console component (versions prior to 2.1.4 ) is vulnerable to SQL injection due to a lack of validation on the sort field sent from the front-end. Because the back-end uses this unvalidated field directly to generate SQL queries, an authenticated attacker can execute arbitrary quer...

CVE-2023-52290 Apache StreamPark (incubating): Unchecked SQL query fields trigger SQL injection vulnerability

In streampark-console the list pagese.g: application pages, users can sort page by field. This sort field is sent from the front-end to the back-end, and the SQL query is generated using this field. However, because this sort field isn't validated, there is a risk of SQL injection...