MSFM backend table/list? Interface s_name has SQL injection

CVE-2024-57765
find by Chaitin Security Research Lab

Vulnerability Product: wangl1989/MSFM
Vulnerability version: before 2025.01.01
Vulnerability type: SQL injection
Vulnerability Details：
1. Global search found that parameter concatenation through ${name} in the mapper/TableDao. xml: 47 path can cause SQL injection. This method is implemented in the listPage() method. Continue to find where this method is defined
![输入图片说明](https://foruda.gitee.com/images/1736134500997985136/7e279638_13737655.png "屏幕截图")
2. Entering the TableDao layer, at com/mysiteforme/admin/dao/TableDao. java: 21, the path name parameter is placed in the map mapping and passed to the listPage() method. Continue to see where this method is called
![输入图片说明](https://foruda.gitee.com/images/1736134513916973578/c6889651_13737655.png "屏幕截图")
3. Continuing the analysis, we come to com/mysiteforme/admin/service/ipl/TableServiceImpl. java: 198. The route listPage() method is called, and it can be seen from above that this operation is implemented in the selectTablePage() method
![输入图片说明](https://foruda.gitee.com/images/1736134527553480033/28ec38bc_13737655.png "屏幕截图")
4. When we arrived at the controller control layer, we found that the selectTablePage() method was called on the admin/system/table route. Continuing to analyze, com/mysiteform/admin/controller/system/TableController. java: 70 can retrieve all parameters starting with s_ from the request and store them in a Map object. If the map is not empty, convert the parameters obtained by HTTP to string type and assign them to the parameter name. Further analysis shows that the passed parameters will directly enter the admin/system/table/list template file
![输入图片说明](https://foruda.gitee.com/images/1736134550608508343/edf54460_13737655.png "屏幕截图")
5. When entering the template file templates/admin/system/table/list. ftl: 21, when the user inputs s_name, the form will directly pass the user's input value to the server after submission. The entire process does not filter or escape the parameter value of s_name. Therefore, we can trigger SQL injection vulnerabilities by controlling the s_name parameter
![输入图片说明](https://foruda.gitee.com/images/1736134570568303254/1f4e8da3_13737655.png "屏幕截图")
6. Construct POC, log in to the backend to capture packets, and replace cookies

```
POST /admin/system/table/list HTTP/1.1
Host: 127.0.0.1:8083
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: XXX
X-Requested-With: XMLHttpRequest24

limit=10&page=1&s_name=1
```

```
python sqlmap.py -u "http://127.0.0.1:8083/admin/system/table/list" --data="limit=10&page=1&s_name=1"  --cookie="XXXXX" -p s_name  --current-db
```

![输入图片说明](https://foruda.gitee.com/images/1736134627721897560/a45c03d6_13737655.png "屏幕截图")

wangl1989/MSFM

Content Risk Flag

Comments (0)

wangl1989/MSFM .gitee-modal { width: 500px !important; }

Content Risk Flag