Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-30500

CVE-2022-30500: SQL injection in jflyfox jfinal

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-30500
GHSA ID
GHSA-595x-hh6c-hfv8
EPSS Score
0.46114%
CWE
CWE-89
Published
5/27/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
com.jflyfox:jflyfox_jfinalmaven<= 5.1.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability is a SQL injection in the background mode (admin interface), as indicated by the GitHub issue. JFinal applications commonly use Db.find() or similar methods for database operations. The lack of parameterized queries in user input handling (e.g., using getPara() with string concatenation) would directly cause this vulnerability. While no exact code is provided, the high-severity CVE and SQLI context strongly suggest a controller method processing admin requests with raw SQL containing user inputs.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

J*in*l *ms *.*.* is vuln*r**l* to SQL Inj**tion.

Reasoning

T** vuln*r**ility is * SQL inj**tion in t** ***k*roun* mo** (**min int*r****), *s in*i**t** *y t** *it*u* issu*. J*in*l *ppli**tions *ommonly us* `**.*in*()` or simil*r m*t*o*s *or **t***s* op*r*tions. T** l**k o* p*r*m*t*riz** qu*ri*s in us*r input