Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-34115

CVE-2022-34115: Dataease v1.11.1 SQL Injection via parameter dataSourceId

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-34115
GHSA ID
GHSA-vjmr-6pmm-rprf
EPSS Score
0.29179%
CWE
CWE-89
Published
7/23/2022
Updated
1/30/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
io.dataease:dataease-plugin-commonmaven< 1.11.21.11.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability combines two CWEs. For CWE-434: The GitHub issue #2428 demonstrates a file write via the 'id' parameter in /driver/file/upload, confirmed by the release note stating a fix for 'arbitrary file write via driver management'. The parameter is used unsafely in path construction. For CWE-89: The CVE title and GHSA explicitly mention SQLi via dataSourceId, and the release note fixes 'unauthorized SQL execution' in dataset previews. While the exact SQLi code isn't shown, the dataSourceId's role in SQL execution and lack of pre-validation in v1.11.1 strongly suggest insecure SQL concatenation. Medium confidence for the SQLi function due to indirect evidence.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

**t***s* v*.**.* w*s *is*ov*r** to *ont*in * SQL inj**tion vuln*r**ility vi* t** p*r*m*t*r `**t*Sour**I*`. V*rsion *.**.* *ont*ins * *ix.

Reasoning

T** vuln*r**ility *om*in*s two *W*s. *or *W*-***: T** *it*u* issu* #**** **monstr*t*s * *il* writ* vi* t** 'i*' p*r*m*t*r in `/*riv*r/*il*/uplo**`, *on*irm** *y t** r*l**s* not* st*tin* * *ix *or '*r*itr*ry *il* writ* vi* *riv*r m*n***m*nt'. T** p*r*