| Title | erzhongxmu JEEWMS 3.7 SQL Injection |
|---|
| Description | JEEWMS v3.7 cgformSqlController.doMigrateIn (数据库导入表单/database form import) decompresses an uploaded ZIP with MigrateForm.unzip() without sanitizing entry names, allowing path traversal to write files to arbitrary locations on the server. Combined with the fact that attacker-controlled JSP content is written under the web application directory, this leads to Remote Code Execution.
Vulnerable code (org.jeecgframework.web.cgform.service.migrate.MigrateForm.java):
- unzip() line 689: File targetFile = buildFile(directoryPath + File.separator + zipEntry.getName(), false);
- buildFile() line 728-729: File target = new File(fileName); // NO sanitization of "../"
The zip entry name is concatenated directly into the extraction path without filtering "../", so a ZIP containing an entry named "../webshell.jsp" escapes the target directory and writes the file to an arbitrary path.
Verified chain (local reproduction):
1. Craft a ZIP with entry "../rce_proof.jsp" containing JSP code: <%out.println("RCE_PROOF_"+System.getProperty("user.home"));%>
2. POST it to /cgformSqlController.do?doMigrateIn (authenticated, multipart field "file")
3. The file is written to webapps/jeewmsupload/rce_proof.jsp (escaped to parent dir via "../")
4. Accessing http://host/jeewmsupload/rce_proof.jsp returns "RCE_PROOF_C:\Users\syz" (HTTP 200) - the JSP executed, proving Remote Code Execution.
Impact: Any authenticated low-privilege user can upload a ZIP containing a webshell with a "../" traversal entry name, write it to a web-accessible directory, and achieve arbitrary code execution on the server (RCE). The write path and filename are fully attacker-controlled, making this a deterministic pre-command-code-execution primitive.
Vulnerable code file: src/main/java/org/jeecgframework/web/cgform/service/migrate/MigrateForm.java:665-739, triggered by src/main/java/org/jeecgframework/web/cgform/controller/build/CgformSqlController.java:196 |
|---|
| Source | ⚠️ https://github.com/erzhongxmu/JEEWMS |
|---|
| User | Lib0gus (UID 101005) |
|---|
| Submission | 09/04/2026 12:44 (2 months ago) |
|---|
| Moderation | 10/11/2026 10:15 (1 month later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 304816 [Growatt Cloud Applications up to 3.5.x authorization] |
|---|
| Points | 0 |
|---|