Executive brief
mfish-nocode-pro is a low-code development platform that allows users to manage database connections and query data. A SQL injection vulnerability in the database connection module allows authenticated users to extract sensitive database information (usernames, database names, versions, and potentially broader data) through a specially crafted request, bypassing the normal permission controls that should restrict database access.
Technical details
The vulnerability is a SQL injection in the /sys/dbConnect/data endpoint where the tableSchema parameter is concatenated directly into a MySQL SELECT statement without validation (unlike the tableName parameter, which is properly whitelisted). An attacker can inject SQL by breaking out of the backtick identifier context with a backtick character. The vulnerability requires an authenticated user session but does not require the sys:database:query permission due to missing @RequiresPermissions annotation on the endpoint. The injected SQL executes within a SELECT COUNT(0) wrapper, allowing error-based extraction using MySQL's extractvalue() function to leak data in exception messages. The vulnerable code is in TableServiceImpl.getDataTable() at lines 120–131.
Affected products
- mfish mfish-nocode-pro v1.0.0
Timeline
- 2026-09-08: disclosed