JEEWMS-graphReportController.do?# There is an SQL injection vulnerability in store_comde

CVE-2025-0392
find by Chaitin Security Research Lab

Vulnerability Product: JEEWMS
Vulnerability version: before 2025.01.01
Vulnerability type: SQL injection
Vulnerability Details：
1. By analyzing org/jeecgframework/web/graphreport/controller/GraphReportController. java: 303, execute the datagridGraph method when there is a datagridGraph parameter on the routing GraphReportController. Then, go down to org/jeecgframework/web/graphreport/controller/GraphReportController. java: 325 and call the CgReportQueryParamUtil. loadQueryParams() method to retrieve query conditions from the request side and store them in queryparams. Continue tracking the method
![输入图片说明](https://foruda.gitee.com/images/1735899428182955927/a7c4edb9_13737655.png "屏幕截图")
2. Arriving at the loadQueryParams() method, org/jeecgframework/core/online/util/CgReportQueryParamUtil.java: 39 specifies the value of obtaining filedName, and the value of the filedName parameter is equal to store_comde. Therefore, we can pass the value from the client through store_comde and directly obtain all data from the client through org/jeecgframework/core/online/tilt/CGReportQueryParamUtil. java: 49 and pass it to the URI string
![输入图片说明](https://foruda.gitee.com/images/1735899458410692645/bda4e559_13737655.png "屏幕截图")
3. Continue analyzing org/jeecgframework/core/online/tilt/CgReportQueryParamUtil. java: 60. Simply check if the parameter value has an "*" and then enter else to determine if the parameter value is concatenated and passed to queryparams
![输入图片说明](https://foruda.gitee.com/images/1735899483764756892/ee0e1df9_13737655.png "屏幕截图")
4. Continuing back to the controller layer, pass the data obtained from the user side to the graphReportService. queryByCgReportSQL () method at org/jeecgframework/web/graphReport/cntroller/GraphReportController. java: 329
![输入图片说明](https://foruda.gitee.com/images/1735899512530912862/90fb1172_13737655.png "屏幕截图")
5. Arriving at the queryByCgReportSQL () method, org/jeecgframework/web/graphreport/service/impl/core/GraphReportServiceImpl.java: Pass the parameter values and SQL statement to the handleElInSQL() method to obtain a new SQL query statement, and then continue to pass the new SQL to the getFullsql() method
![输入图片说明](https://foruda.gitee.com/images/1735899541659621569/1f3b17a1_13737655.png "屏幕截图")
6. Enter the getFullSQL () method, org/jeecgframework/web/graphreport/service/impl/core/GraphReportServiceImpl.java: 145. Simply determine whether the parameter value is empty and concatenate it directly with the dynamic SQL statement
![输入图片说明](https://foruda.gitee.com/images/1735899570862444573/406225ff_13737655.png "屏幕截图")
7. Continuing back to the queryByCgReportSQL () method, org/jeecgframework/web/graphreport/service/impl/core/GraphReportServiceImpl.java: Pass the obtained new query statement to the jdbcDao. findForJdbc() method
![输入图片说明](https://foruda.gitee.com/images/1735899604262078595/c2429537_13737655.png "屏幕截图")
8. The findForJdbc() method for tracking the jdbcDao layer is executed in an SQL query statement at org/jeecgframework/core/common/dao/jdbc/JdbcDao. java: 149, which concatenates the store_comde parameter values directly. The entire process does not filter or escape the parameters, so the store_comde parameter is controllable. There is an SQL injection vulnerability here
![输入图片说明](https://foruda.gitee.com/images/1735899633075592692/8081e557_13737655.png "屏幕截图")
9. Construct POC, log in to the backend to capture packets, and replace cookies

```
http://localhost:8083/jeewms/graphReportController.do?datagridGraph&configId=CWSYL&store_code=1
admin/llg123
```

10. Using sqlmap to reproduce, the attack statement is as follows

```
python sqlmap.py -u "http://localhost:8083/jeewms/graphReportController.do?datagridGraph&configId=CWSYL&store_code=1" --cookie="JSESSIONID=B0A3B7BC426F86462B08A69CA6F88FF9; JEECGINDEXSTYLE=ace; ZINDEXNUMBER=1990; Hm_lvt_a4980171086658b20eb2d9b523ae1b7b=1713256699,1713260101" -p store_code --current-db
```
![输入图片说明](https://foruda.gitee.com/images/1735899717480172195/ece24052_13737655.png "屏幕截图")

GVP JeeWMS/JeeWMS

内容风险标识

评论 (0)

GVPJeeWMS/JeeWMS

内容风险标识