जमा करें #596573: xxyopen novel-plus 5.1.3 SQL Injection

A critical SQL injection vulnerability exists in the user management module. The `/list` endpoint, which retrieves a list of system users, unsafely uses string substitution (`${...}`) for the `sort` and `order` parameters within its MyBatis `ORDER BY` clause. This allows any authenticated user who can access this endpoint to execute arbitrary SQL commands. Because the query targets the `sys_user` table, this flaw can be exploited to exfiltrate highly sensitive information, including usernames, email addresses, and password hashes, compromising all user accounts on the system.

• स्रोत: ⚠️ https://blog.0xd00.com/blog/sqli-in-user-list-leads-to-sensitive-data-disclosure
• उपयोगकर्ता: bpy9ft (UID 85221)
• सबमिशन: 13/06/2025 11:38 AM (1 वर्ष पहले)
• संयम: 23/06/2025 04:32 PM (10 days later)
• स्थिति: स्वीकृत
• VulDB प्रविष्टि: 313654 [xxyopen/201206030 novel-plus तक 5.1.3 User Management UserMapper.xml list sort/order SQL इंजेक्शन]
• अंक: 20