Executive brief
cool-admin-java is a Java-based administrative framework. A security flaw in its database handling allows an attacker to manipulate database queries. By sending a specially crafted request, an authenticated user could bypass security controls to view sensitive information from the database that they are not authorized to see.
Technical details
A SQL injection vulnerability exists in cool-admin-java 8.0.0 within the `order()` method of `src/main/java/com/cool/core/request/CrudOption.java`. The vulnerability stems from the application taking the user-supplied 'order' parameter from HTTP requests and directly concatenating it into a MyBatis-Flex `QueryWrapper.orderBy` call without validation or parameterization. Because the `orderBy` method treats the input as a raw SQL fragment, an authenticated attacker can perform blind SQL injection. This affects 14 different controllers that extend `BaseController`, including those managing users, roles, and system logs. Exploitation requires a valid JWT token.
Affected products
- cool-team-official cool-admin-java 8.0.0
Timeline
- 2026-05-14: disclosed: Issue reported on GitHub repository
- 2026-07-17: advisory: CVE published by NVD/MITRE