search

Hello-hao / Tbed

Hellohao图床 | 图像托管 | 云相册，分享/水印、存储源分发、图像管理、前后端分离。
https://tbed.hellohao.cn
GNU Affero General Public License v3.0
1.36k stars 242 forks source link

SQL Injection Vulnerability #67

Open Tyaoo opened 7 months ago

Tyaoo commented 7 months ago

[Suggested description] Tbed was discovered to contain a SQL injection vulnerability via the searchname parameter.

[Vulnerability Type] SQLi

[Vendor of Product] https://github.com/Hello-hao/Tbed

[Affected Product Code Base] v20240111

[Affected Component]

/admin/selectPhoto

[Attack Type] Remote

[Vulnerability details]

image

image

[Impact Code execution] true

[Cause of vulnerability] The searchname parameter was used in ${} format which can cause SQL Injection Vulnerability. image

That's all, thanks.

Hello-hao commented 7 months ago

Thank you for raising this vulnerability. I will make improvements in the next version.