RainyGao DocSys SQL Injection Vulnerability in GroupMemberMapper.xml

A SQL injection vulnerability has been identified in RainyGao DocSys versions through 2.02.36. The issue arises in the '/Manage/getGroupAllUsers.do' interface, where the 'searchWord' argument can be manipulated to execute unauthorized SQL commands. This vulnerability allows attackers to access sensitive database information or potentially gain database or server-level permissions. The vulnerability can be exploited remotely, and a public exploit is available.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate database queries to access, modify, or delete database information. Additionally, according to the vulnerability submission, this SQL injection could lead to taking over database or even server permissions.

Reproduction

The vulnerability can be reproduced by sending a request to the '/Manage/getGroupAllUsers.do' interface with a crafted 'searchWord' parameter that exploits the SQL injection flaw. This can be done using a tool like SQLMap, targeting the 'searchWord' parameter to automate the exploitation process.