CVE-2023-52290

In streampark-console the list pages(e.g: application pages), users can sort page by field. This sort field is sent from the front-end to the back-end, and the SQL query is generated using this field. However, because this sort field isn't validated, there is a risk of SQL injection vulnerability. The attacker must successfully log into the system to launch an attack, which may cause data leakage. Since no data will be written, so this is a low-impact vulnerability. Mitigation: all users should upgrade to 2.1.4, Such parameters will be blocked.

• CWE-89

• https://lists.apache.org/thread/t3mcm8pb65d9gj3wrgtj9sx9s2pfvvl3Mailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2024/07/15/4Mailing List, Third Party Advisory
• https://lists.apache.org/thread/t3mcm8pb65d9gj3wrgtj9sx9s2pfvvl3Mailing List, Vendor Advisory

Published

Jul 16, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-52284Bytecode Alliance wasm-micro-runtime (aka WebAssembly Micro …5.5
• CVE-2023-52285ExamSys 9150244 allows SQL Injection via the /Support/action…7.5
• CVE-2023-52286Tencent tdsqlpcloud through 1.8.5 allows unauthenticated rem…7.5
• CVE-2023-52288An issue was discovered in the flaskcode package through 0.0…7.5
• CVE-2023-52289An issue was discovered in the flaskcode package through 0.0…7.5
• CVE-2023-5229The E2Pdf WordPress plugin before 1.20.20 does not sanitize …4.8
• CVE-2023-52291In streampark, the project module integrates Maven's compila…4.7
• CVE-2023-52292IBM Sterling File Gateway 6.0.0.0 through 6.1.2.5 and 6.2.0.…5.4
• CVE-2023-52296IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Se…5.3
• CVE-2023-5230The TM WooCommerce Compare & Wishlist plugin for WordPress i…5.4
• CVE-2023-52302Nullptr in paddle.nextafter in PaddlePaddle before 2.6.0. Th…7.5
• CVE-2023-52303Nullptr in paddle.put_along_axis in PaddlePaddle before 2.6.…7.5