CVE-2021-28890

EUVD-2021-15543
J2eeFAST 2.2.1 allows remote attackers to perform SQL injection via the (1) compId parameter to fast/sys/user/list, (2) deptId parameter to fast/sys/role/list, or (3) roleId parameter to fast/sys/role/authUser/list, related to the use of ${} to join SQL statements.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 64%
Affected Products (NVD)
VendorProductVersion
j2eefastj2eefast
2.2.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://gitee.com/zhouhuanOGP/J2EEFAST/issues/I3BOFQ
https://gitee.com/zhouhuanOGP/J2EEFAST/issues/I3BOFQ