PT-2025-47128 · Unknown · Dromara Datacompare

R1Ckyz · Published 2025-11-17 · Updated 2025-11-17 · CVE-2025-13268

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dromara dataCompare versions up to 1.0.1

Description A flaw exists in Dromara dataCompare related to the JDBC URL Handler component. The issue resides within the DbConfig function of the file src/main/java/com/vince/xq/project/system/dbconfig/service/DbconfigServiceImpl.java. Manipulation of this function can lead to injection, and the attack can be launched remotely. An exploit for this issue has been published.

Recommendations Versions prior to 1.0.1 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Neutralization

Special Elements Injection

Weakness Enumeration

CWE-707

CWE-74

Related Identifiers

CVE-2025-13268

Affected Products

Dromara Datacompare

References · 8

• 🔥 https://github.com/dromara/dataCompare/issues/13 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-13268 · Security Note
• https://osv.dev/vulnerability/CVE-2025-13268 · Vendor Advisory
• https://t.me/CVEtracker/37479 · Telegram Post
• https://t.me/cveNotify/142983 · Telegram Post
• https://vuldb.com/?submit.689460 · Note
• https://vuldb.com/?ctiid.332603 · Note
• https://vuldb.com/?id.332603 · Note