Fangtang7

**Name of the Vulnerable Software and Affected Versions** MCMS versions prior to 6.2.1 **Description** The front-end interface '/cms/category/list' is susceptible to SQL injection. The `size` parameter is directly concatenated into the LIMIT clause of a SQL query via FreeMarker `${size}` without proper parameterization or binding. Although the `SqlInjectionUtil` function uses regular expression blacklist filtering, it fails to include keywords such as CREATE, TABLE, SET, PREPARE, and EXECUTE, which allows the filter to be bypassed. This enables unauthenticated attackers to execute stacked SQL statements. **Recommendations** Update MCMS to a version newer than 6.2.0. As a temporary mitigation, restrict access to the '/cms/category/list' endpoint or avoid using the `size` parameter until the software is updated.

**Name of the Vulnerable Software and Affected Versions** DocSys-master version 2.02.85 **Description** An arbitrary file read issue exists in the 'downloadDocEx' interface located in src/com/DocSystem/controller/DocController.java. This allows an attacker to read files from the system that they should not have access to. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** tamguo version 1.5.3 **Description** An unrestricted file upload issue allows for stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. The '/uploadFile' and '/imgUpload' endpoints within `FileUploadController.java` and `UEditorController.java` lack file type validation, enabling attackers to upload arbitrary HTML or JavaScript files to the server. **Recommendations** Update tamguo version 1.5.3 to a version that implements strict file type validation for the '/uploadFile' and '/imgUpload' endpoints.

**Name of the Vulnerable Software and Affected Versions** super-diamond-server versions prior to 1.3.4 **Description** The front-end interface '/superdiamond/preview/{projectCode}/{module}/{type}' is susceptible to SQL injection. This occurs because the `module` parameter is directly concatenated into a SQL IN clause using `StringUtils.split()` and string concatenation, rather than being parameterized and bound. **Recommendations** Update super-diamond-server to version 1.3.4 or later. As a temporary mitigation, restrict access to the '/superdiamond/preview/{projectCode}/{module}/{type}' endpoint or avoid using the `module` parameter until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Funiture version 1.0.0 **Description** SQL Injection occurs in the backend tool interfaces. This issue affects the endpoints '/sys/tool/select.json' and '/sys/tool/update.json'. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the endpoints '/sys/tool/select.json' and '/sys/tool/update.json' to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** jetlinks community version 2.11 **Description** The device metadata import interface '/device/instance/{productId}/property-metadata/import' is susceptible to Server-side request forgery (SSRF), a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. The vulnerable parameter is `{productId}`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.