zrlog<=2.2.4 There is an SQL injection vulnerability in the sord parameter in the background file management search box to obtain sensitive information
The order parameter in the find method of Log.java may cause order by injection.
After the attacker enters the background, use the search box function of the article management office, and then capture packets. If there is no sidx parameter, add the sidx parameter and set its value to typeId, and the value of the sord parameter to asc, extractvalue(0x7e, concat(0x7e, user(), 0x7e)). It can cause SQL injection.
Payload:
[Other parameters]&sidx=typeId&sord=asc,extractvalue(0x7e,concat(0x7e,user(),0x7e))
such as:
