CVE-2022-36599: 
Java vulnerability analysis and mitigation

Mingsoft MCMS version 5.2.8 was discovered to contain a SQL injection vulnerability in the /mdiy/model/delete URI via models Lists. The vulnerability was discovered and reported on July 20, 2022 (Gitee Issue).

The vulnerability exists in the route /${ms.manager.path}/mdiy/model/delete where the application processes the models object from frontend input. The application iterates through the ModelTableName values in the models object and passes them to the modelBiz.dropTable method. In the dropTable method implementation, the table parameter is directly concatenated into the SQL query without proper parameterization or sanitization, leading to SQL injection (Gitee Issue).

An attacker can exploit this vulnerability to perform arbitrary SQL operations on the database, including creating new tables, modifying existing data, or potentially accessing sensitive information. The vulnerability allows for stacked queries, meaning multiple SQL statements can be executed in sequence (Gitee Issue).

The vulnerability can be exploited by an authenticated user with access to the custom template functionality. The attacker needs to first create a custom template, then intercept and modify the modelTableName parameter during the template deletion process to inject malicious SQL commands (Gitee Issue).

The vulnerability was addressed in version 5.2.9 of MCMS. Users should upgrade to this version or later to protect against this vulnerability (Gitee Issue).