CVE-2023-52290

Apache StreamPark (specifically streampark-console ) is vulnerable to SQL injection in its list pages, such as the application pages. The root cause is the lack of validation for the sort field sent from the front-end to the back-end, which is used directly to generate SQL queries. An attacker mu...

CVE-2023-52290 Apache StreamPark (incubating): Unchecked SQL query fields trigger SQL injection vulnerability

In streampark-console the list pagese.g: application pages, users can sort page by field. This sort field is sent from the front-end to the back-end, and the SQL query is generated using this field. However, because this sort field isn't validated, there is a risk of SQL injection...