[mgaffigan]

Derby and MySQL allow EOP via SQLi at GET /events?name=<payload>. Authentication is still required, so this vulnerability specifically affects MySQL or Derby users that are using RBAC.

[github-actions]

Test Results

130 files  ±0  130 suites  ±0   4m 2s ⏱️ + 1m 0s
789 tests ±0  789 ✅ ±0  0 💤 ±0  0 ❌ ±0 
915 runs  ±0  909 ✅ ±0  6 💤 ±0  0 ❌ ±0 

Results for commit ddee97f. ± Comparison against base commit a403039.

[tonygermano]

suggestion (non-blocking): Gemini said you can do this in a database-agnostic way where the concatenation occurs before it hits the database engine.

<if test='name != null'>
    <bind name="namePattern" value="'%' + name + '%'" />
    AND LOWER(NAME) LIKE LOWER(#{namePattern})
</if>