A SQL injection vulnerability in Mybatis plus below 3.5.3.1 allows remote attackers to execute arbitrary SQL commands via the tenant ID valuer. NOTE: the vendor's position is that this can only occur in a misconfigured application; the documentation discusses how to develop applications that avoid SQL injection.
References
| Link | Resource |
|---|---|
| https://github.com/FCncdn/MybatisPlusTenantPluginSQLInjection-POC/blob/master/Readme.en.md | Exploit Third Party Advisory |
| https://baomidou.com/reference/about-cve/ |
Configurations
History
29 May 2024, 07:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| Summary | A SQL injection vulnerability in Mybatis plus below 3.5.3.1 allows remote attackers to execute arbitrary SQL commands via the tenant ID valuer. NOTE: the vendor's position is that this can only occur in a misconfigured application; the documentation discusses how to develop applications that avoid SQL injection. |
14 Apr 2023, 15:56
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mybatis mybatis
Mybatis |
|
| References | (MISC) https://github.com/FCncdn/MybatisPlusTenantPluginSQLInjection-POC/blob/master/Readme.en.md - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-89 | |
| CPE | cpe:2.3:a:mybatis:mybatis:*:*:*:*:*:*:*:* |
05 Apr 2023, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-05 14:15
Updated : 2024-08-02 12:15
NVD link : CVE-2023-25330
Mitre link : CVE-2023-25330
JSON object : View
Products Affected
mybatis
- mybatis
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')