In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection.
| Software | From | Fixed in |
|---|---|---|
| bladex / springblade | 3.6.0 | 3.6.0.x |
org.springblade / blade-core-tool
|
3.6.0 | 3.6.0.x |