BradWenqiang HR Background Management register selectAll sql injection

Vulnerability

A critical SQL injection vulnerability exists in BradWenqiang HR version 2.0. The flaw resides in the selectAll function of the file /bishe/register within the Background Management component. The userName parameter is directly concatenated into SQL queries without proper sanitization. The call chain involves the selectAll() method in the controller, which invokes the service layer's selectAll() method, which in turn calls the mapper layer's selectAllListPage() method where the vulnerable SQL statement is executed [1].

Exploitation

An attacker can exploit this vulnerability remotely without authentication by sending a crafted HTTP request to the route r=bishe/register?userName= with a malicious SQL payload in the userName parameter. Tools like sqlmap can automate the exploitation to extract database contents [1].

Impact

Successful exploitation allows an attacker to execute arbitrary SQL commands, leading to unauthorized access to the underlying database. This can result in disclosure, modification, or deletion of sensitive data, potentially compromising the entire application and its data [1].

Mitigation

As of the publication date, the vendor has not responded to the disclosure and no official patch is available. Users should implement input validation and parameterized queries to mitigate the risk. Additionally, restricting network access to the Background Management interface can reduce exposure [1].