Skip to content

[CVE-2022-28505] SQL injection vulnerability exists in JFinal CMS 5.1.0 #33

Open
@N1ce759

Description

SQL injection vulnerability exists in JFinal CMS 5.1.0

Analysis

The vulnerability appears in lines 23-47 of the com.jflyfox.system.log.LogController.java
image

Here call SQLUtils to query with the following statement:

select count(*)  from sys_log t where 1=1

When the length of model.getAttrValues() is not equal to 0, go into the if branch and call the whereEquals() method to concatenate
whereEquals()
image

The SQL statement after concatenation is as follows:

select count(*)  from sys_log t where 1=1 AND t.log_type = 1 

Moving on, the orderBy parameter is concatenated to the end of the SQL statement
String orderBy = getBaseForm().getorDerby (); defines the source of the orderBy argument
getBaseForm():
image
getOrderBy():
image

The orderBy parameter is the form.OrderColumn parameter passed from the front end
So you can construct payload to exploit this vulnerability

Exploit

Maven Startup Environment
Vulnerability address: /jfinal_cms/system/log/list
Administrator login is required. The default account password is admin:admin123
image

Injection parameters: form.orderColumn
payload:) AND (SELECT 6361 FROM (SELECT(SLEEP(5)))tAVU)-- woqr
image

SQLMAP Injection:
image

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions