| 标题 | Beijing Bairong Qianyu Software Technology Development Co., Ltd. SiteServer CMS 7.2.1 CWE-89 |
|---|
| 描述 | The STL search endpoint does not require an authenticated administrator session. The endpoint decrypts and parses the supplied template. If the template contains an stl:sqlContents element, its query content is passed to the database layer and executed as a raw SQL statement without parameterization, filtering, or statement-type restrictions.
The default database connection is the main SSCMS database connection. This allows an attacker who can obtain or replay a valid encrypted template containing stl:sqlContents to read arbitrary database data, including administrator credentials and application configuration.
Technical Details
The vulnerable flow is:
POST /api/stl/actions/search
→ request.Template is decrypted
→ STL template parser processes stl:sqlContents
→ StlSqlContents.ParseAsync
→ ParserGetSqlDataSourceAsync
→ connection.ExecuteReaderAsync(queryString)
The relevant sink is:
SSCMS.Core/Services/DatabaseManager.Parser.cs:13-31
The query string is executed directly using ExecuteReaderAsync without parameter binding.
The default connection string is initialized from:
SSCMS.Core/StlParser/Models/ListInfo.cs:41
The search endpoint is:
SSCMS.Web/Controllers/Stl/ActionsSearchController.Submit.cs
Proof of Concept
Send a request to:
POST /api/stl/actions/search
with a valid encrypted template whose decrypted content contains:
<stl:sqlContents><stl:queryString>SELECT * FROM siteserver_Administrator</stl:queryString><stl:sqlContent type="userName"></stl:sqlContent></stl:sqlContents>
The request body can use the following structure:
{"isAllSites":false,"siteId":1,"type":"Title","word":"123","isDefaultDisplay":false,"template":"<valid encrypted template>","page":1}
In the tested deployment, the response returned administrator table data.
A second injection path exists when the decrypted template contains request entities such as {Request.x} inside the SQL query. The search request value is substituted into the query before execution.
Impact
An unauthenticated attacker may:
Read arbitrary database tables
Extract administrator accounts and password hashes
Extract database connection strings and application secrets
Modify data if the underlying database driver permits multi-statement execution
Potentially achieve further compromise through exposed credentials or configuration
Remediation
Do not allow anonymous requests to execute stl:sqlContents
Remove raw SQL execution from externally reachable template paths
Restrict SQL templates to trusted administrators and server-side stored template IDs
Use an allowlist of permitted queries and database connections
Never execute user-controlled query text through ExecuteReaderAsync
Disclosure Status
Unpatched / fixed version unknown. |
|---|
| 用户 | BlackSpdier (UID 89912) |
|---|
| 提交 | 2026-09-01 03時41分 (1 月前) |
|---|
| 管理 | 2026-10-10 17時08分 (1 month later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 360387 [Siteserver SSCMS 7.4.0 /api/stl/actions/dynamic SQL注入] |
|---|
| 积分 | 0 |
|---|