| शीर्षक | https://github.com/risesoft-y9/WorkFlow-Engine y9-flowable / WorkFlow-Engine current (9.6.x) v9.6.x Unauthorized access + SQL blind injection (processadmin front en |
|---|
| विवरण | The processadmin OAuth2 resource filter only covers protectedUrlPatterns: /vue/*,/editor/*,/modeler*（application.yml:264），while /services/rest/* is guarded only by CommonParamsFilter, which takes client headers X-Tenant-Id/X-User-Id into the user context / tenant datasource with no token or session check（ProcessAdminConfiguration.java:142-144、CommonParamsFilter.java:37-58). HistoricProcessApiImpl (/services/rest/historicProcess, HistoricProcessApiImpl.java:31) is therefore fully reachable without authentication. Its getByIdAndYear (HistoricProcessApiImpl.java:81-82 → CustomHistoricProcessServiceImpl.java:76-87) concatenates year into a table-name position and processInstanceId into a single-quoted string position then runs native SQL — "SELECT * from ACT_HI_PROCINST_" + year + " p where p.PROC_INST_ID_ = '" + processInstanceId + "'" (CustomHistoricProcessServiceImpl.java:80) — no parameterization, so the whole database is extractable by boolean blind injection without logging in. |
|---|
| स्रोत | ⚠️ https://github.com/fangtang7/CVE/blob/main/WorkFlow-Engine/sql.md |
|---|
| उपयोगकर्ता | 3265048908 (UID 100110) |
|---|
| सबमिशन | 21/08/2026 11:47 AM (2 महीनों पहले) |
|---|
| संयम | 29/09/2026 04:18 PM (1 month later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 411406 [risesoft-y9 WorkFlow-Engine तक 9.6.10 OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear year/processInstanceId SQL इंजेक्शन] |
|---|
| अंक | 20 |
|---|