analysis

The ExeSQL component extracts the SQL statement from the input and sends it directly to the database query, resulting in SQL injection vulnerability

PoC

Send a command to let the ExeSQL component query all users in the user table

select user from mysql.user;