CVE-2025-13268Dromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injection

Descripción

A flaw has been found in Dromara dataCompare up to 1.0.1. The affected element is the function DbConfig of the file src/main/java/com/vince/xq/project/system/dbconfig/service/DbconfigServiceImpl.java of the component JDBC URL Handler. Executing manipulation can lead to injection. The attack can be launched remotely. The exploit has been published and may be used.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• VDB-332603 | Dromara dataCompare JDBC URL DbconfigServiceImpl.java DbConfig injection vdb-entrytechnical-description
• VDB-332603 | CTI Indicators (IOB, IOC, TTP, IOA) signaturepermissions-required
• Submit #689460 | dromara dataCompare 1.0.1 Improper Input Validation third-party-advisory
• https://github.com/dromara/dataCompare/issues/13 exploitissue-tracking