SQL injection vulnerability exists in JFinal CMS 5.1.0
Analysis
The vulnerability appears in lines 23-47 of the com.jflyfox.system.log.LogController.java
Here call SQLUtils to query with the following statement:
select count(*) from sys_log t where 1=1
When the length of model.getAttrValues() is not equal to 0, go into the if branch and call the whereEquals() method to concatenate
whereEquals()：
The SQL statement after concatenation is as follows:
select count(*) from sys_log t where 1=1 AND t.log_type = 1
Moving on, the orderBy parameter is concatenated to the end of the SQL statement
String orderBy = getBaseForm().getorDerby (); defines the source of the orderBy argument
getBaseForm():
getOrderBy()：
The orderBy parameter is the form.OrderColumn parameter passed from the front end
So you can construct payload to exploit this vulnerability
Exploit
Maven Startup Environment
Vulnerability address: /jfinal_cms/system/log/list
Administrator login is required. The default account password is admin:admin123
Injection parameters: form.orderColumn
payload：) AND (SELECT 6361 FROM (SELECT(SLEEP(5)))tAVU)-- woqr
SQL injection vulnerability exists in JFinal CMS 5.1.0
Analysis
The vulnerability appears in lines 23-47 of the com.jflyfox.system.log.LogController.java
Here call SQLUtils to query with the following statement:
When the length of model.getAttrValues() is not equal to 0, go into the if branch and call the whereEquals() method to concatenate whereEquals()：
The SQL statement after concatenation is as follows:
Moving on, the orderBy parameter is concatenated to the end of the SQL statement String orderBy = getBaseForm().getorDerby (); defines the source of the orderBy argument getBaseForm():
getOrderBy()：
The orderBy parameter is the form.OrderColumn parameter passed from the front end So you can construct payload to exploit this vulnerability
Exploit
Maven Startup Environment Vulnerability address: /jfinal_cms/system/log/list Administrator login is required. The default account password is admin:admin123
Injection parameters: form.orderColumn payload：) AND (SELECT 6361 FROM (SELECT(SLEEP(5)))tAVU)-- woqr
SQLMAP Injection：