CVE-2022-27466
📋 TL;DR
MCMS v5.2.27 contains a SQL injection vulnerability in the orderBy parameter at /dict/list.do endpoint. This allows attackers to execute arbitrary SQL commands on the database. Any organization running this specific version of MCMS is affected.
💻 Affected Systems
- MCMS
📦 What is this software?
Mcms by Mingsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, or full system takeover via SQL injection to RCE chaining.
Likely Case
Database information disclosure, data manipulation, or authentication bypass through SQL injection.
If Mitigated
Limited impact if proper input validation and parameterized queries are implemented.
🎯 Exploit Status
SQL injection vulnerabilities are commonly weaponized and this has public proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v5.2.28 or later
Vendor Advisory: https://github.com/ming-soft/MCMS/issues/90
Restart Required: Yes
Instructions:
1. Backup your current installation. 2. Download and install MCMS v5.2.28 or later from the official repository. 3. Restart the application server. 4. Verify the fix is applied.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for the orderBy parameter to only allow expected values.
WAF Rule
allDeploy a web application firewall rule to block SQL injection patterns targeting the /dict/list.do endpoint.
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries for the orderBy parameter.
- Restrict access to the /dict/list.do endpoint using network controls or authentication.
🔍 How to Verify
Check if Vulnerable:
Test the /dict/list.do endpoint with SQL injection payloads in the orderBy parameter and observe database errors or unexpected behavior.Check Version:
Check the MCMS version in the application configuration or admin panel.Verify Fix Applied:
After patching, test the same endpoint with SQL injection payloads and verify they are rejected or properly handled.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- HTTP requests to /dict/list.do with suspicious orderBy parameters
Network Indicators:
- HTTP POST/GET requests to /dict/list.do containing SQL keywords in parameters
SIEM Query:
source="web_logs" AND uri_path="/dict/list.do" AND (param="orderBy" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "OR")