Key Information Summary 1. Product Information Name: TDuck Platform Version: Community Edition v5.1 Repository: https://gitee.com/TDuckApp/tduck-platform / https://github.com/TDuckCloud/tduck-platform 2. Vulnerability Type Type: SQL Injection (SQLi) 3. Affected Component POST 4. Attack Vector Attackers can exploit this vulnerability by injecting malicious SQL expressions into the parameter in the endpoint. The backend uses this parameter in dynamic SQL construction without proper input validation or parameterized queries, leading to SQL injection. 5. Proof of Concept (PoC) If the vulnerability exists, the response will include an error message, as shown in the screenshot, confirming successful SQL injection and leakage of database user information. 6. Vulnerable Code Reference These code files directly concatenate the client-provided parameter into SQL statements without any validation or parameterized queries, allowing attackers to inject arbitrary SQL code via the parameter. 7. Impact Data leakage (e.g., database users, names) Potential unauthorized access Depending on the DBMS, could escalate to full system control 8. References Gitee Project Link: Gitee Project Link