Description
A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-table access control and read arbitrary database tables via the Map-form @having operator.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Tencent | APIJSON | 7.1.0 – ≤ 8.1.8 | — |
References
- Product third-party-advisory
- Vulnerable File technical-description