Description
Xiaozhi ESP32 Server Java是joey个人开发者的一个 Java 企业级管理平台。 Xiaozhi ESP32 Server Java存在注入漏洞，该漏洞源于对参数state的错误操作会导致SQL注入。
Xiaozhi ESP32 Server Java 注入漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/joey-zhou/xiaozhi-esp32-server-java/issues/143
https://nvd.nist.gov/vuln/detail/CVE-2025-3382
https://access.redhat.com/security/cve/cve-2025-3382
https://dbugs.ptsecurity.com/vulnerability/PT-2025-15292
https://cert.kenet.or.ke/cve-2025-3382-joey-zhou-xiaozhi-esp32-server-java-sql-injection-vulnerability
https://www.redpacketsecurity.com/cve_alert_cve-2025-3382/