A SQL injection vulnerability in Mybatis plus below 3.5.3.1 allows remote attackers to execute arbitrary SQL commands via the tenant ID valuer. NOTE: the vendor's position is that this can only occur in a misconfigured application; the documentation discusses how to develop applications that avoid SQL injection.
References
| Link | Resource |
|---|---|
| https://baomidou.com/reference/about-cve/ | |
| https://github.com/FCncdn/MybatisPlusTenantPluginSQLInjection-POC/blob/master/Readme.en.md | Exploit Third Party Advisory |
| https://baomidou.com/reference/about-cve/ | |
| https://github.com/FCncdn/MybatisPlusTenantPluginSQLInjection-POC/blob/master/Readme.en.md | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 07:49
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://baomidou.com/reference/about-cve/ - | |
| References | () https://github.com/FCncdn/MybatisPlusTenantPluginSQLInjection-POC/blob/master/Readme.en.md - Exploit, Third Party Advisory |
29 May 2024, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) A SQL injection vulnerability in Mybatis plus below 3.5.3.1 allows remote attackers to execute arbitrary SQL commands via the tenant ID valuer. NOTE: the vendor's position is that this can only occur in a misconfigured application; the documentation discusses how to develop applications that avoid SQL injection. | |
| References |
|
Information
Published : 2023-04-05 14:15
Updated : 2024-11-21 07:49
NVD link : CVE-2023-25330
Mitre link : CVE-2023-25330
CVE.ORG link : CVE-2023-25330
JSON object : View
Products Affected
mybatis
- mybatis
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')