SQL Injection in mfish-nocode-pro Application

Executive Summary

This is a SQL injection vulnerability in mfish-nocode-pro v1.0.0 affecting the /sys/dbConnect/data endpoint. The tableSchema parameter is passed unfiltered into a MySQL query without validation, allowing attackers to inject malicious SQL statements. The tableName parameter is validated but tableSchema is not, enabling exploitation.

Useful 0 Not Useful 0

Detection Guidance

To detect this SQL injection vulnerability, monitor network traffic for requests to the /sys/dbConnect/data endpoint with suspicious tableSchema parameters. Check application logs for error-based SQL injection patterns like extractvalue() or database version leaks. Use tools like SQLmap to test for injection by sending crafted payloads to the parameter.

Useful 0 Not Useful 0

Impact Analysis

Attackers can access sensitive database information by injecting crafted SQL statements. They can retrieve data like current user, database name, or MySQL version through error messages. Exploitation requires a logged-in user with database connection access but bypasses permission checks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It enables data breaches that may result in regulatory penalties and loss of compliance certifications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update mfish-nocode-pro to a patched version if available. As a temporary fix, add input validation for the tableSchema parameter using a strict whitelist regex. Implement the @RequiresPermissions annotation to enforce sys:database:query permission checks on the endpoint. Disable error-based SQL injection by suppressing detailed database errors in responses.

Useful 0 Not Useful 0