| शीर्षक | Shenzhen Gongji Technology Co., Ltd. XBROTHER Dynamic Environment Monitoring System / XBROTHER-动环监控系统 V300R004C00B300 and below CWE-89 (SQL Injection) |
|---|
| विवरण | The order parameters at the /xbreport/api/v1/plamange/plansImmediate endpoint are vulnerable to unauthorized SQL injection. An attacker can exploit this vulnerability without any authentication.
In the backend code (PlanController.getImmediatePlans), the sort parameter is directly passed to MyBatis ${orderField} without any validation (no ClassUtil.checkOrder or ClassUtil.findField), and the order parameter is directly passed to ${order}. Both are concatenated into the ORDER BY clause as raw strings, leading to SQL injection.
Successful exploitation allows an attacker to extract database contents including database version, current user, database names, table names, column names, and any stored data via error-based injection techniques (updatexml, extractvalue, floor+group by). |
|---|
| स्रोत | ⚠️ https://ucn9h68n9289.feishu.cn/docx/WgJYd7q4CopTQKxqWuWcJEpinde?from=from_copylink |
|---|
| उपयोगकर्ता | Anonymous User |
|---|
| सबमिशन | 10/07/2026 08:42 AM (1 महीना पहले) |
|---|
| संयम | 23/08/2026 06:33 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 394566 [Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System तक 300R004C00B300 plansImmediate PlanController.getImmediatePlans order/sort SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|