Description
A vulnerability classified as critical has been found in chillzhuang SpringBlade 4.1.0. Affected is an unknown function of the file /api/blade-system/menu/list?updatexml. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| chillzhuang | SpringBlade | 4.1.0 | — |
References
- VDB-275292 | chillzhuang SpringBlade list sql injection vdb-entry
- VDB-275292 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #390087 | chillzhuang SpringBlade v4.1.0 SQL Injection third-party-advisory
- https://gist.github.com/topsky979/74dcbe81062718f314d81fb6ad5dc1e0 exploit