Executive brief
WebStack-Guns is a Spring Boot-based bookmark management CMS with an administrative interface. An authenticated attacker with admin credentials can inject arbitrary SQL commands through the sort parameter in log list endpoints, allowing them to read or modify database contents, alter user passwords, and disrupt service availability. The product ships with publicly documented default administrator credentials, making un-hardened deployments vulnerable to remote exploitation.
Technical details
The vulnerability is an authenticated SQL injection (CWE-89) in the PageFactory.defaultPage component and the LogController/LoginLogController classes. The sort parameter from HTTP requests is extracted without validation and passed directly to MyBatis XML mappers, where it is substituted into the ORDER BY clause using string interpolation (${orderByField}) instead of prepared statements. An authenticated administrator can supply crafted SQL expressions—such as (select sleep(5)) or (select database())—that execute with database privileges. The attack requires valid administrator credentials or a compromised admin session, but default credentials (admin/111111) are publicly documented in the project README, significantly lowering the barrier to exploitation on unmodified deployments.
Affected products
- jsnjfz WebStack-Guns 1.0
Timeline
- 2025-12-01: disclosed: Public disclosure via GitHub
- other: Vendor was contacted early but did not respond