-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| apache-submarine | pip | >= 0.7.0, < 0.8.0 | 0.8.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from MyBatis XML mapper files using ${parameter} interpolation in LIKE clauses instead of #{} parameter binding. This pattern appears in multiple query operations handling user-controlled inputs (username, email, search filters). The commit fixes demonstrate replacement with concat('%', #{param}, '%') to safely parameterize inputs. The added SQL injection test in SysUserServiceTest.java specifically validates the login-related query vulnerability. All identified functions directly process authentication/search parameters without proper input sanitization, making them clear injection vectors.