| शीर्षक | https://gitee.com/oufu/ofcms OFCMS v1.1.3 SQL Injection |
|---|
| विवरण | An SQL injection vulnerability exists in the SysUserController.java component of ofcms v1.1.3. This vulnerability lies in the /admin/system/user/getData.json interface, which is called when processing query requests using the query() method. The vulnerability stems from improper validation of the field parameter. Because this parameter is directly appended to the ORDER BY clause of the backend SQL, attackers can perform blind SQL injection by constructing complex SQL expressions (including nested subqueries and Boolean logic). |
|---|
| स्रोत | ⚠️ https://gitee.com/oufu/ofcms/issues/IJLL09 |
|---|
| उपयोगकर्ता | DaytimeHeaven (UID 96977) |
|---|
| सबमिशन | 07/05/2026 08:42 AM (1 महीना पहले) |
|---|
| संयम | 31/05/2026 08:36 AM (24 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 367484 [OFCMS 1.1.3 JSON Query Interface SysUserController.java query SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|