CVE-2025-29085 PoC — vipshop Saturn SQL注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-29085.yaml

Associated Vulnerability

Title:vipshop Saturn SQL注入漏洞 (CVE-2025-29085)
Description:vipshop Saturn是中国唯品会（vipshop）公司的一个提供分布式、容错、高可用的作业调度服务的平台。 vipshop Saturn 3.5.1及之前版本存在安全漏洞，该漏洞源于zkClusterKey组件存在SQL注入，可能导致远程代码执行。

Description

SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component.

File Snapshot


 id: CVE-2025-29085

info:
  name: Vipshop Saturn Console <= 3.5.1 - SQL Injection via ClusterKey Com

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!