CyberRota Analysis
AI-GeneratedThe report module in smart-web2 v1.3.1 is susceptible to arbitrary SQL execution due to the sqlResource.sql parameter being directly embedded into Hibernate native queries without proper parameterization or filtering. This vulnerability could allow an attacker to execute malicious SQL commands, potentially compromising the integrity and confidentiality of the database. Organizations using this version of smart-web2 should prioritize addressing this issue to mitigate the risk of data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql parameter is stored in the t_report_sql_resource table through the ReportController.save() interface and directly embedded into Hibernate native queries without any parameterization or filtering.