SQL Injection Vulnerability

[Tyaoo]

[Suggested description] Tbed was discovered to contain a SQL injection vulnerability via the searchname parameter.

[Vulnerability Type] SQLi

[Vendor of Product] https://github.com/Hello-hao/Tbed

[Affected Product Code Base] v20240111

[Affected Component]

/admin/selectPhoto

[Attack Type] Remote

[Vulnerability details]

[Impact Code execution] true

[Cause of vulnerability] The searchname parameter was used in ${} format which can cause SQL Injection Vulnerability.

That's all, thanks.

[Hello-hao]

Thank you for raising this vulnerability. I will make improvements in the next version.