CVE-2022-28111
📋 TL;DR
This CVE describes a time-blind SQL injection vulnerability in MyBatis PageHelper. Attackers can exploit the orderBy parameter to execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion. All applications using vulnerable versions of MyBatis PageHelper are affected.
💻 Affected Systems
- MyBatis PageHelper
📦 What is this software?
Pagehelper by Pagehelper Project
Pagehelper by Pagehelper Project
Pagehelper by Pagehelper Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, modification, deletion, and potential remote code execution via database functions.
Likely Case
Data extraction from the database, including sensitive information like user credentials, personal data, and business records.
If Mitigated
Limited impact due to proper input validation, parameterized queries, and database permission restrictions.
🎯 Exploit Status
Time-blind SQL injection requires timing analysis but is well-documented and relatively easy to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v5.3.1 and later
Vendor Advisory: https://github.com/pagehelper/Mybatis-PageHelper/issues/674
Restart Required: Yes
Instructions:
1. Update MyBatis PageHelper dependency to version 5.3.1 or later. 2. Update pom.xml or build.gradle with new version. 3. Rebuild and redeploy application. 4. Restart application server.
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to sanitize orderBy parameter inputs
Implement custom filter/interceptor to validate orderBy parameter against whitelist of allowed column names
Database Permission Reduction
allRestrict database user permissions to minimum required
REVOKE unnecessary privileges from application database user
🧯 If You Can't Patch
- Implement WAF rules to block SQL injection patterns in orderBy parameter
- Deploy database firewall to monitor and block suspicious SQL queries
🔍 How to Verify
Check if Vulnerable:
Check project dependency file (pom.xml or build.gradle) for MyBatis PageHelper version within vulnerable rangesCheck Version:
grep -i pagehelper pom.xml || grep -i pagehelper build.gradleVerify Fix Applied:
Confirm MyBatis PageHelper version is 5.3.1 or later in dependency file and verify application functions correctly📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries with time delays
- Multiple failed orderBy parameter attempts
- Suspicious orderBy parameter values
Network Indicators:
- HTTP requests with crafted orderBy parameters containing SQL keywords
- Unusually long response times for orderBy requests
SIEM Query:
web_access_logs | where orderBy contains any('sleep', 'waitfor', 'benchmark', 'pg_sleep')🔗 References
- https://github.com/pagehelper/Mybatis-PageHelper
- https://github.com/pagehelper/Mybatis-PageHelper.git
- https://github.com/pagehelper/Mybatis-PageHelper/issues/674
- https://github.com/yangfar/CVE/blob/main/CVE-2022-42227.md
- https://pagehelper.github.io/
- https://www.cnblogs.com/secload/articles/16061420.html
- https://github.com/pagehelper/Mybatis-PageHelper
- https://github.com/pagehelper/Mybatis-PageHelper.git
- https://github.com/pagehelper/Mybatis-PageHelper/issues/674
- https://github.com/yangfar/CVE/blob/main/CVE-2022-42227.md
- https://pagehelper.github.io/
- https://www.cnblogs.com/secload/articles/16061420.html
