pig-mesh Pig vulnerabilities

In pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function, it is possible to execute any Java class with a parameterless constructor and its methods with a String parameter through reflection. Using the eval method in Tomcat's built-in jakarta.el.ELProcessor class, commands can be executed, leading to remote code execution.

A SQL injection vulnerability was found in pig-mesh pig up to version 4.1.0, affecting the orderItem.getColumn function in SqlFilterArgumentResolver.java. Manipulating the ascs/descs arguments allows SQL injection, and the attack can be launched remotely. The exploit has been published and may be used.

A code injection vulnerability was found in pig-mesh Pig up to version 3.9.2 in the pig-codegen component. The issue affects an unknown functionality of the GeneratorServiceImpl.java file. The attack can be launched remotely and the exploit is publicly available.