Uploaded image for project: 'MariaDB Connector/J'
  1. MariaDB Connector/J
  2. CONJ-1340

SQL injection via unescaped identifiers in updatable ResultSet generated statements

    XMLWordPrintable

Details

    Description

      UpdatableResult builds its INSERT / UPDATE / DELETE / SELECT and SHOW COLUMNS statements by wrapping the schema, table and column names in backticks without doubling backticks contained in the name.

      see https://github.com/mariadb-corporation/mariadb-connector-j/pull/236

      Attachments

        Activity

          People

            diego dupin Diego Dupin
            diego dupin Diego Dupin
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Git Integration

                Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.