Go-CMS SQL Injection Vulnerability Allowing Arbitrary Code Execution

A SQL injection vulnerability has been identified in Go-CMS version 1.1.10. This vulnerability allows remote attackers to execute arbitrary code by sending a crafted payload. The issue arises when exporting user or role data, as the application improperly concatenates IDs into SQL queries, creating an opportunity for injection.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing arbitrary code on the server.

Reproduction

To reproduce this vulnerability, send a POST request to the '/cms/roles/export' or '/cms/users/export' endpoint. Include a payload in the 'ids' field that exploits the SQL query handling, such as injecting SQL commands that could be executed by the database.