Ruisibi Rsbi-Pom SQL Injection Vulnerability in DatasetService Path

A time-based blind SQL injection vulnerability has been identified in Ruisibi's Rsbi-Pom version 4.7. The issue occurs within the DatasetService path of the application.

Impact

Exploitation of this vulnerability allows for time-based blind SQL injection, where an attacker can manipulate SQL queries and potentially extract information from the database or interfere with database operations.

Reproduction

To reproduce this vulnerability, send a POST request to the '/bi/service/model/queryDatasetMeta.action' endpoint. Include a payload that injects SQL commands into the 'cfg' parameter, specifically targeting the 'queryDsetDatas' function. The injection can be verified by observing a time delay in the application's response, indicating that the injected SQL command was executed.