SQL Injection in java110 MicroCommunity

Executive Summary

This is an unauthenticated SQL injection vulnerability in MicroCommunity v2.0 and earlier. It exists in the /businessApi/fallBack endpoint where the fallBackSql parameter allows attackers to inject raw SQL commands. The flaw occurs because MyBatis uses unsafe string concatenation instead of parameterized binding, enabling direct SQL execution without authentication.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthenticated access to the /businessApi/fallBack endpoint by sending a GET or POST request without credentials. Look for SQL injection attempts in logs by searching for the fallBackSql parameter with suspicious SQL keywords like UPDATE, DELETE, DROP, or UNION.

Useful 0 Not Useful 0

Impact Analysis

Attackers can execute arbitrary SQL commands like UPDATE, DELETE, INSERT, DROP, CREATE, ALTER, or exfiltrate the entire database without credentials. They may also modify the java_script column in the c_service_sql table to achieve remote code execution by refreshing the Redis cache with default credentials.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for data protection (GDPR, HIPAA) due to unauthorized database access, potential data exfiltration, and lack of authentication controls. It enables complete database compromise, which would breach confidentiality and integrity requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the /businessApi/fallBack endpoint by updating the JWT filter to enforce authentication. Replace unsafe MyBatis string concatenation (${value}) with parameterized binding (#{value}) in the QueryServiceSMOImpl.fallBack function. Disable the unauthenticated /businessApi/query endpoint if not required.

Useful 0 Not Useful 0