| शीर्षक | renrenio renren-security 5.1.0 SQL Injection |
|---|
| विवरण | The `getPage()` method in `BaseServiceImpl.java` constructs pagination queries using user-supplied `orderField` and `order` parameters without any input validation or whitelist enforcement. The application directly passes the attacker-controlled `orderField` value into MyBatis-Plus's `OrderItem.asc()` / `OrderItem.desc()` methods, which perform raw string concatenation into the SQL `ORDER BY` clause.
Because the sorting column name in an `ORDER BY` statement cannot be parameterized with prepared statements (`?` placeholders), MyBatis-Plus inserts the field name directly into the generated SQL query. Consequently, an attacker can inject arbitrary SQL expressions through the `orderField` parameter, leading to a time-based blind SQL injection or error-based SQL injection vulnerability. |
|---|
| स्रोत | ⚠️ https://github.com/ltxonesec/vulnerability-reports/blob/main/MyBatis%20Plus%20ORDER%20BY%20SQL%20Injection%20in%20BaseServiceImpl.getPage()%20orderField%20Parameter.md |
|---|
| उपयोगकर्ता | LTXsec (UID 99848) |
|---|
| सबमिशन | 16/07/2026 10:31 AM (3 महीनों पहले) |
|---|
| संयम | 12/09/2026 09:57 AM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 348557 [renren-secuity तक 5.4.x BaseServiceImpl.java SQL इंजेक्शन] |
|---|
| अंक | 0 |
|---|