Executive Summary

CVE-2026-2954 is an injection vulnerability in Dromara UJCMS version 10.0.2, specifically in the importChanel function of the ImportDataController component. The vulnerability occurs because the application accepts user-supplied parameters driverClassName and url without proper validation and uses them directly to establish a JDBC database connection.

This lack of validation allows attackers to perform injection attacks remotely by manipulating these parameters. The attacks can lead to arbitrary file reads or remote code execution depending on the database drivers present in the application.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several serious ways:

• Arbitrary File Read: Attackers can trick the server into reading and uploading sensitive local files such as /etc/passwd or C:/Windows/win.ini by connecting to a malicious rogue MySQL server.
• Remote Code Execution (RCE): If certain vulnerable database drivers are present, attackers can execute arbitrary system commands on the server by crafting malicious JDBC URLs.
• Compromise of confidentiality, integrity, and availability of the affected system.

The vulnerability is remotely exploitable, has a public proof-of-concept exploit, and no known vendor mitigations are available.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability affects the importChanel endpoint of the ImportDataController in Dromara UJCMS 10.0.2, where unvalidated driverClassName and url parameters are passed to DriverManagerDataSource. Detection involves monitoring for suspicious JDBC URL or driverClassName parameters that could indicate injection attempts.'}, {'type': 'paragraph', 'content': 'Since the vulnerability allows injection via JDBC URLs, network detection could focus on identifying unusual or malicious JDBC connection attempts, such as those using MySQL LOAD DATA LOCAL INFILE or H2 RUNSCRIPT commands.'}, {'type': 'paragraph', 'content': 'Suggested commands to detect exploitation attempts might include searching application logs or network traffic for suspicious JDBC URLs or driverClassName parameters. For example, using grep on server logs:'}, {'type': 'list_item', 'content': "grep -i 'driverClassName' /path/to/ujcms/logs/*"}, {'type': 'list_item', 'content': "grep -i 'jdbc:' /path/to/ujcms/logs/*"}, {'type': 'list_item', 'content': 'tcpdump or Wireshark filters to capture suspicious JDBC traffic patterns or connections to rogue MySQL servers.'}, {'type': 'paragraph', 'content': 'Additionally, monitoring for unexpected outbound connections to unknown database servers or unusual file read operations triggered by the LOAD DATA LOCAL INFILE feature could help detect exploitation.'}] [1, 3]

Useful 0 Not Useful 0

Mitigation Strategies

No vendor patches or fixes are currently available for this vulnerability, and the vendor did not respond to early notifications.

Immediate mitigation steps include:

• Restrict or disable access to the vulnerable importChanel endpoint to prevent remote exploitation.
• Implement input validation or filtering on the driverClassName and url parameters to block malicious JDBC URLs or driver names.
• Monitor and block suspicious outbound connections to unknown or rogue database servers.
• Consider replacing or upgrading the affected component or product if possible.

Users should also apply network-level protections such as firewall rules to limit access to the affected service and monitor logs for signs of exploitation attempts.

Useful 0 Not Useful 0