Vendor
AllData versions 0.7.1 and earlier are vulnerable to unauthenticated JDBC injection via the /jobJdbcDatasource/test endpoint, enabling remote attackers to perform arbitrary file read via the MySQL allowLoadLocalInfile parameter.