Executive brief
L-ONE is an open-source Java-based office automation platform. The system contains SQL injection flaws in its attachment management API endpoints that allow authenticated users to extract sensitive data from the underlying database by crafting malicious requests. An attacker with ordinary user credentials can read database contents including business data and internal system information.
Technical details
The vulnerability is a SQL injection in the /attachment/getBusinessUploadList endpoint, where user-supplied parameters (busid, id, taskid) are concatenated directly into SQL statements without parameterized queries or input validation. The vulnerable code uses JFinal's Db.paginate() method with string concatenation (e.g., "and o.business_id='"+busid+"'"), allowing attackers to inject SQL syntax. Authentication is required (ordinary user account), and the attacker must have network access to the application. An authenticated attacker can execute error-based, UNION-based, or blind SQL injection attacks to extract database names, table structures, and sensitive data. A patch involving parameterized query conversion is expected from the vendor.
Affected products
- L-ONE L-ONE v1.0.0
Timeline
- 2026-09-08: disclosed