CVE-2022-4375: 
Java vulnerability analysis and mitigation

A critical SQL injection vulnerability was discovered in Mingsoft MCMS versions up to 5.2.9, identified as CVE-2022-4375. The vulnerability affects the category list query interface in the front-end of the application, specifically in the /cms/category/list endpoint. The issue was initially reported on November 18, 2022 (Gitee Issue).

The vulnerability exists in the category list query interface where user input in the sqlWhere parameter is not properly sanitized. The issue allows attackers to inject malicious SQL commands through the field parameter, which can be exploited to extract sensitive database information. The vulnerability specifically affects the content title model functionality (Gitee Issue).

If successfully exploited, this vulnerability allows attackers to execute arbitrary SQL queries against the backend database, potentially leading to unauthorized access to sensitive data, manipulation of database contents, and exposure of internal database information (Gitee Issue).

The vulnerability has been fixed in Mingsoft MCMS version 5.2.10. Users are advised to upgrade to this version or later to address the security issue (Gitee Issue).