| 标题 | pig-mesh Pig 4.1.0 SQL injection |
|---|
| 描述 | Pig4Cloud (pig-mesh/pig) through 4.1.0 is vulnerable to SQL injection via the
ascs/descs pagination sort parameters.
The framework globally registers SqlFilterArgumentResolver, which reads the
ascs/descs HTTP parameters and passes their values as sort column names into
MyBatis-Plus OrderItem objects. Since the ORDER BY clause cannot use
prepared-statement placeholders, the value is concatenated into the SQL
statement as a raw string:
sql.append(" ORDER BY ").append(orderItem.getColumn()).append(" DESC");
The only protection is MyBatis-Plus SqlInjectionUtils.check(), a regex blacklist
with three structural defects:
(1) SQL_COMMENT_PATTERN requires a leading single quote, so omitting quotes
disables comment-based filtering entirely;
(2) SQL_SYNTAX_PATTERN enumerates only a limited set of function names
(if/select/substr/substring/char/concat/benchmark/sleep) and does not cover
case/when/then/hex/lower/like;
(3) the "(and|or)\s+.*" alternative requires trailing whitespace, so a bare "or"
passes through.
An authenticated attacker can therefore inject arbitrary SQL expressions and read
data from any table present in the query, including columns not returned by the API.
Verified on a self-built lab (Pig v4.1.0, MySQL 8.4.5, JDK 17). The payload
case((lower(hex(password)))LIKE(0x<hex-prefix>%))when(1)then(user_id)else(phone)end
allowed full extraction of sys_user.password (bcrypt hash, 120 hex characters), a
field absent from the API response. The extracted value matched the ground truth
exactly at all 120 positions.
This is the same class of issue as CVE-2020-16165 (SpringBlade ascs/desc ORDER BY
injection in /api/blade-log/api/list). The distinction is that Pig4Cloud does
implement a protection, but it is a bypassable regex blacklist rather than the
whitelist adopted by later fixes of this class (cf. CVE-2026-7060 sortField,
CVE-2026-63039 orderField/orderType).
No fix is available as of v4.1.0 (latest release, 2026-07-08). The vulnerable code
path is identical in v3.9.2 and v4.1.0; only the package name and the parameter
parsing method differ.
Any authenticated user, including the lowest-privileged ordinary user, can exploit
this issue. Classified as SQL Injection (CWE-89). |
|---|
| 来源 | ⚠️ https://github.com/vinch3s/pig4cloud-cve/blob/main/Pig4Cloud-SQL-Injection.md |
|---|
| 用户 | v1nches (UID 101432) |
|---|
| 提交 | 2026-09-19 10時17分 (1 月前) |
|---|
| 管理 | 2026-10-24 11時22分 (1 month later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 426095 [pig-mesh pig 直到 4.1.0 SqlFilterArgumentResolver.java orderItem.getColumn ascs/descs SQL注入] |
|---|
| 积分 | 20 |
|---|