dbgate-api

DbGate API: Arbitrary Code Execution via Unsanitized functionName in POST /runners/load-reader

The POST /runners/load-reader endpoint directly interpolates the functionName parameter into a JavaScript code template without sa