ZJ1983 ZZ SQL Injection Vulnerability in ZroleAction Component

A critical SQL injection vulnerability has been identified in ZJ1983 ZZ versions up to August 2024. The issue resides in the 'getUserList' function of the 'ZroleAction.java' file. The vulnerability is triggered by manipulating the 'roleid' parameter, allowing remote attackers to inject malicious SQL code. This exploitation has been publicly disclosed.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can manipulate database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

After logging into the application, the vulnerability can be reproduced by sending a GET request to the 'OpenImportUsersListForRole' endpoint with a crafted 'roleid' parameter. This request should include the necessary headers to mimic a standard browser request, such as 'User-Agent' and 'Accept'. The injected SQL payload can then be verified using a tool like sqlmap, which will confirm the presence of the SQL injection vulnerability.