SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_msg/list/1/10.
References
Link | Resource |
---|---|
https://github.com/dataease/dataease/issues/510 | Exploit Issue Tracking Vendor Advisory |
Configurations
History
No history.
Information
Published : 2023-02-15 22:15
Updated : 2024-02-28 19:51
NVD link : CVE-2021-38239
Mitre link : CVE-2021-38239
CVE.ORG link : CVE-2021-38239
JSON object : View
Products Affected
dataease
- dataease
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')