RainyGao DocSys SQL Injection Vulnerability in ReposAuthMapper.xml

A SQL injection vulnerability has been identified in RainyGao DocSys versions through 2.02.36. The issue resides in the ReposAuthMapper.xml file, specifically within the /Manage/getReposAllUsers.do interface. The vulnerability allows attackers to manipulate the searchWord parameter, potentially leading to unauthorized access to sensitive database information or elevated database and server permissions. This vulnerability can be exploited remotely, and a proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability allows for SQL injection, which could be used to access or manipulate database information. Additionally, according to the vulnerability submission, this SQL injection could lead to gaining database or even server permissions.

Reproduction

The vulnerability can be reproduced by sending a request to the /Manage/getReposAllUsers.do interface with a crafted searchWord parameter that exploits the SQL injection flaw. This can be done using a tool like SQLMap, targeting the searchWord parameter to automate the exploitation process.