Executive brief
smart-web2 is an open-source Java-based Office Automation (OA) system used for enterprise workflow and reporting. The report module contains a SQL injection vulnerability that allows authenticated users to execute arbitrary database queries, including reading sensitive data from system tables, modifying records, or potentially uploading malicious files to the server. An attacker with valid credentials can extract database contents, manipulate data, or establish a foothold for further compromise.
Technical details
This is a SQL injection vulnerability in the report module's ReportController.save() interface. The sqlResource.sql parameter is received from HTTP POST requests without sanitization and stored directly in the t_report_sql_resource table. When reports are executed via ReportInstanceService.getDatas(), the stored SQL is passed to Hibernate's queryObjSql() and countSql() methods without parameterized queries or filtering, allowing direct execution of arbitrary SQL. The vulnerability requires authenticated access but affects all user roles. An attacker can execute SELECT, INSERT, UPDATE, DELETE, and DROP commands, exfiltrate database content including system tables (mysql.user), and potentially write files using INTO OUTFILE syntax.
Affected products
- smart-web2 smart-web2 1.3.1
Timeline
- 2026-08-26: disclosed