Executive brief
jfinal_cms is a Java-based content management system used to build and manage websites. A security vulnerability in the system's feedback and administrative modules allows an attacker to manipulate database queries. This could lead to unauthorized access to sensitive information, data modification, or disruption of the website's operations.
Technical details
A SQL injection vulnerability exists in jflyfox jfinal_cms up to version 5.1.0 due to improper neutralization of the 'orderBy' parameter. The vulnerability is located in the list() function of several components, most notably AdvicefeedbackController.java, where the 'orderBy' argument is directly appended to SQL queries without sanitization. A remote attacker with low-level privileges can exploit this by sending crafted network requests to manipulate database queries. This can result in unauthorized data retrieval, modification, or deletion. As of the advisory date, the project maintainers have not responded to the issue report, and no official patch is available.
Affected products
- jflyfox jfinal_cms up to 5.1.0
Timeline
- 2026-01-26: disclosed: Issue reported on GitHub repository
- 2026-06-08: advisory: CVE published to NVD