PowerJob config leak: allowMultiQueries widens SQLi attack surface

Vulnerability Key Information Summary Vulnerability Overview Vulnerability Type: SQL Injection (SQL Injection) Vulnerability Location: configuration file Vulnerability Description: The is configured with a MySQL connection string that includes the parameter. This parameter allows the execution of multiple SQL statements within a single connection, potentially expanding the attack surface for SQL injection. Impact Scope Affected Component: module Affected File: (daily environment configuration file) Affected Versions: branch of the current repository Key Configuration (POC/Exploitation Code) ```properties Data source configuration (includes allowMultiQueries=true, expanding SQL injection surface) spring.datasource.url=jdbc:mysql://127.0.0.1:3306/powerjob?useUnicode=true&characterEncoding=UTF-8&serverTimezone=Asia/Shanghai&allowMultiQueries=true spring.datasource.username=root spring.datasource.password= spring.datasource.core.maxActive=10 spring.datasource.core.maxWait=10000 spring.datasource.core.minIdle=5 spring.datasource.core.maxIdle=20 spring.datasource.core.maxWait=10000 spring.datasource.core.minIdle=5 Storage configuration oms.storage.dfs.mysql.url=jdbc:mysql://127.0.0.1:3306/powerjob?useUnicode=true&characterEncoding=UTF-8&serverTimezone=Asia/Shanghai&allowMultiQueries=true oms.storage.dfs.mysql.username=root oms.storage.dfs.mysql.password= oms.storage.dfs.mysql.series.autoCreateTable=true oms.storage.dfs.mysql.series.autoCreateTable=true Mail configuration spring.mail.host=smtp.163.com spring.mail.username=zzq@163.com spring.mail.password=QZP2P8R9020W spring.mail.properties.mail.smtp.auth=true spring.mail.properties.mail.smtp.starttls.enable=true spring.mail.properties.mail.smtp.starttls.required=true DingTalk configuration oms.alarm.ding.app-key=dingp2p8r9020w oms.alarm.ding.app-secret=0a1a12m3q4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0

Goal Reached Thanks to every supporter — we hit 100%!

PowerJob config leak: allowMultiQueries widens SQLi attack surface

More from this source