Executive brief
ZS-Admin, a Java-based administrative management system, contains a security flaw in its department management module. An authenticated user can manipulate database queries through the sorting parameters used in page views. This could allow an attacker to view sensitive database information or metadata that they are not authorized to see, potentially compromising the integrity of the system's data.
Technical details
A SQL injection vulnerability exists in ZS-Admin's SysDeptController, specifically within the /api/system/sys/dept/page endpoint. The vulnerability is rooted in the PageInfo pagination component, which takes the user-supplied 'orderField' parameter and passes it directly to MyBatis-Plus OrderItem.asc() or OrderItem.desc() methods without proper whitelist validation. While the input undergoes a transformation to underline case, it remains unsanitized before being appended to the SQL ORDER BY clause. An authenticated attacker with 'sys:dept:page' permissions can inject SQL expressions (e.g., using updatexml or other functions) to extract database metadata or sensitive information. As of the advisory date, the project has not responded to the issue report.
Affected products
- zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead
Timeline
- 2026-06-15: disclosed: Issue reported on GitHub repository
- 2026-07-21: advisory: CVE published and NVD record created