sql inject 3

[novysodope]

src/main/resources/mybatis/system/UserMapper.xml

There is a ${} in this mapper

Search selectUserList to see where the this select id is used：

UserController.java

Query user information：

Follow up the selectUserList method to see the specific implementation：

UserServiceImpl.java

The parameters in the User are passed into the mapper for SQL operation. Because the datascope is controllable, the vulnerability is generated

Verification:

Splice URL and parameters according to code:

params[dataScope]=

Use error injection to query the database version：

params[dataScope]=and+extractvalue(1,concat(0x7e,substring((select+version()),1,32),0x7e))

Select database name: