Vulnerability: Arbitrary File Read and Deserialization in dataCompare ≤ 1.0.1

**BUG_Author:** R1ckyZ

**Affected Version:** dataCompare ≤ 1.0.1

**Vendor:** [dromara](https://github.com/dromara)

**Software:** [dataCompare](https://github.com/dromara/dataCompare)

**Vulnerability** **Files:**

- `src/main/java/com/vince/xq/project/system/dbconfig/service/DbconfigServiceImpl.java`

## Description:

The `DbConfig` does not validate or sanitize the JDBC URL. An attacker can inject dangerous connection parameters such as `allowLoadLocalInfile`, `allowUrlInLocalInfile`, and `autoDeserialize` into the JDBC URL. When the connection test is performed in `DbconfigServiceImpl`, these properties are activated, potentially leading to arbitrary file read, SSRF, or deserialization-based remote code execution.

## Proof of Concept:

1. After logging in, access the API `/system/dbconfig/testConnection` and pass a carefully crafted JDBC connection via POST parameters, as shown in the image below.