rsbi-os Remote Code Execution Vulnerability in sqlite-jdbc

A remote code execution vulnerability has been identified in rsbi-os version 4.7, specifically within the sqlite-jdbc component. This issue arises from a deserialization vulnerability in JDBC that can be exploited by sending malicious responses from a MySQL server, when the autoDeserialize option is enabled.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where rsbi-os is running.

Reproduction

To reproduce this vulnerability, upload a payload as a MySQL link using the JDBC deserialization vulnerability. Set the autoDeserialize parameter to true. After the payload is uploaded, the application will execute the payload, leading to remote code execution.