Tipray Data Leakage Prevention System SQL Injection Vulnerability

A SQL injection vulnerability has been identified in Tipray Data Leakage Prevention System version 1.0. The issue arises in the 'doFilter' function of the 'findDeptPage.do' file, where manipulation of the 'sort' parameter allows for SQL injection. This vulnerability can be exploited remotely, and an exploit is publicly available.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate SQL queries to the database. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a request to 'findDeptPage.do' with a crafted 'sort' parameter that exploits the application's SQL query handling. The injection can be verified by observing a delay in the response, indicating successful exploitation.