CyberRota Analysis
AI-GeneratedDbGate is vulnerable due to inadequate validation of jslid parameters in the jsldata controller, enabling authenticated users to exploit the file:// scheme to read and write arbitrary files. This flaw allows attackers to bypass directory restrictions and potentially access sensitive information, such as encrypted database credentials. Organizations using DbGate should prioritize addressing this vulnerability to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file:// scheme resolution. Attackers can exploit getJslFileName() to bypass directory containment and access sensitive files including encrypted database credentials stored in connections configuration.