PowerJob config leak: allowMultiQueries widens SQLi attack surface

漏洞关键信息总结 漏洞概述 漏洞类型：SQL注入（SQL Injection） 漏洞位置： 配置文件 漏洞描述： 中配置了 MySQL 连接串，其中包含 参数，该参数允许在单次连接中执行多条 SQL 语句，可能扩大 SQL 注入的攻击面。 影响范围 受影响组件： 模块 受影响文件： （daily 环境配置文件） 影响版本：当前仓库 的 分支 关键配置（POC/利用代码） ```properties 数据源配置（含 allowMultiQueries=true，扩大 SQL 注入面） spring.datasource.url=jdbc:mysql://127.0.0.1:3306/powerjob?useUnicode=true&characterEncoding=UTF-8&serverTimezone=Asia/Shanghai&allowMultiQueries=true spring.datasource.username=root spring.datasource.password= spring.datasource.core.maxActive=10 spring.datasource.core.maxWait=10000 spring.datasource.core.minIdle=5 spring.datasource.core.maxIdle=20 spring.datasource.core.maxWait=10000 spring.datasource.core.minIdle=5 存储配置 oms.storage.dfs.mysql.url=jdbc:mysql://127.0.0.1:3306/powerjob?useUnicode=true&characterEncoding=UTF-8&serverTimezone=Asia/Shanghai&allowMultiQueries=true oms.storage.dfs.mysql.username=root oms.storage.dfs.mysql.password= oms.storage.dfs.mysql.series.autoCreateTable=true oms.storage.dfs.mysql.series.autoCreateTable=true 邮件配置 spring.mail.host=smtp.163.com spring.mail.username=zzq@163.com spring.mail.password=QZP2P8R9020W spring.mail.properties.mail.smtp.auth=true spring.mail.properties.mail.smtp.starttls.enable=true spring.mail.properties.mail.smtp.starttls.required=true DingTalk 配置 oms.alarm.ding.app-key=dingp2p8r9020w oms.alarm.ding.app-secret=0a1a12m3q4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t0v2x4z6b8d0f2h4j6l8n0r2t4v6x8z0b2d4f6h8j0l2n4p6r8t

目標達成すべての支援者に感謝 — 100%達成しました！

PowerJob config leak: allowMultiQueries widens SQLi attack surface

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

PowerJob config leak: allowMultiQueries widens SQLi attack surface

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！