jflyfox / jfinal_cms

jfinal cms是一个java开发的功能强大的信息咨询网站,采用了简洁强大的JFinal作为web框架,模板引擎用的是beetl,数据库用mysql,前端bootstrap框架。支持oauth2认证、帐号注册、密码加密、评论及回复,消息提示,网站访问量统计,文章评论数和浏览量统计,回复管理,支持权限管理。后台模块包含:栏目管理,栏目公告,栏目滚动图片,文章管理,回复管理,意见反馈,我的相册,相册管理,图片管理,专辑管理、视频管理、缓存更新,友情链接,访问统计,联系人管理,模板管理,组织机构管理,用户管理,角色管理,菜单管理,数据字典管理。
http://mtg.jflyfox.com/
Apache License 2.0
628 stars 285 forks source link

Some SQL injection vulnerabilities exists in JFinal CMS 5.1.0 #52

Open So4ms opened 2 years ago

So4ms commented 2 years ago

Administrator login is required. The default account password is admin:admin123

admin/videoalbum/list

There is a SQLI vul in background mode.The route is as following

image-20220809173719466

vulnerable argument passing is as following

image-20220809171314338

Successfully injected at route admin/videoalbum/list

image-20220809173732745

admin/video/list

There is a SQLI vul in background mode.The route is as following

image-20220809173822633

vulnerable argument passing is as following

image-20220809171314338

Successfully injected at route admin/video/list

image-20220809173835144

system/department/list

There is a SQLI vul in background mode.The route is as following

image-20220809173912226

vulnerable argument passing is as following

image-20220809171314338

Successfully injected at route system/department/list

image-20220809173923320

system/menu/list

There is a SQLI vul in background mode.The route is as following

image-20220809174004298

vulnerable argument passing is as following

image-20220809171314338

Successfully injected at route system/menu/list

image-20220809174015340

system/role/list

There is a SQLI vul in background mode.The route is as following

image-20220809174057768

vulnerable argument passing is as following

image-20220809171314338

Successfully injected at route system/role/list

image-20220809174108907