CVE-2026-11473: jflyfox jfinal_cms SQLi Vulnerability

CVE-2026-11473 Overview

CVE-2026-11473 is a SQL injection vulnerability in jflyfox jfinal_cms up to version 5.1.0. The flaw resides in the list function of AdvicefeedbackController.java, where the orderBy argument is incorporated into a database query without proper sanitization. An authenticated remote attacker can manipulate this parameter to inject arbitrary SQL statements. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements). According to the VulDB CVE-2026-11473 Entry, the project was notified via an issue report but has not responded.

Critical Impact
Remote attackers with low-privileged access can inject arbitrary SQL queries into the affected endpoint, potentially exposing or modifying backend database contents.

Affected Products

jflyfox jfinal_cms versions up to and including 5.1.0
The vulnerable component is AdvicefeedbackController.java
The affected function is the list function processing the orderBy parameter

Discovery Timeline

2026-06-08 - CVE-2026-11473 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11473

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw in the advice feedback module of jfinal_cms. The list function in AdvicefeedbackController.java accepts an orderBy request parameter and concatenates it directly into an SQL ORDER BY clause. Because the parameter is not validated against an allow-list of column names or sanitized before query construction, an attacker can append arbitrary SQL fragments. This allows information disclosure, data tampering, and in some configurations, escalation toward remote command execution through database functions.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-74]. Parameters intended to control sort order are typically not suitable for prepared statement binding, which makes ORDER BY clauses a common SQL injection sink when developers omit explicit allow-list validation. The jfinal_cms codebase passes the orderBy string directly into query assembly, providing no defensive checks against injected SQL syntax.

Attack Vector

Exploitation occurs remotely over the network. An attacker requires low-level privileges to reach the vulnerable endpoint but no user interaction is needed. The attacker issues a crafted HTTP request to the advice feedback listing endpoint, supplying a malicious orderBy value containing SQL syntax such as subqueries, UNION statements, or conditional time-delay payloads. Because there is no vendor patch available, exploitation remains feasible against current installations. Refer to the GitHub Issue #62 Discussion for community-reported details.

No verified proof-of-concept code is publicly attributed in the enriched data. The vulnerability mechanism follows the standard ORDER BY injection pattern, where the attacker-controlled string is concatenated into the SQL statement executed by the backend.

Detection Methods for CVE-2026-11473

Indicators of Compromise

HTTP requests to the advice feedback listing endpoint containing SQL keywords such as UNION, SELECT, SLEEP, or BENCHMARK in the orderBy parameter
Unusually long response times from the feedback listing endpoint, indicating possible time-based blind SQL injection
Database error messages returned to clients referencing syntax errors near ORDER BY clauses
Anomalous outbound database queries reading from information_schema or system catalog tables

Detection Strategies

Inspect web server and application logs for orderBy values that contain non-alphanumeric characters, whitespace, parentheses, or SQL keywords
Deploy a Web Application Firewall (WAF) rule that matches SQL injection signatures against the orderBy query parameter
Enable database audit logging and alert on queries originating from the jfinal_cms service that reference internal metadata tables
Run authenticated vulnerability scans that test ORDER BY parameters for injection behavior

Monitoring Recommendations

Monitor application logs for repeated HTTP 500 responses from the advice feedback controller, which often accompany injection probing
Alert on database query patterns that include UNION SELECT, conditional sleeps, or queries against mysql.user and similar tables
Correlate authentication logs with anomalous orderBy payloads to identify low-privileged accounts probing the endpoint

How to Mitigate CVE-2026-11473

Immediate Actions Required

Restrict network access to the jfinal_cms administrative and feedback endpoints to trusted internal networks only
Disable or remove the advice feedback module if it is not required in your deployment
Apply WAF rules that block SQL metacharacters in the orderBy parameter for the affected route
Audit application accounts and rotate database credentials if exploitation is suspected

Patch Information

No official patch is available at the time of publication. According to the VulDB CVE-2026-11473 Entry, the maintainers of jfinal_cms were informed through an issue report but have not responded. Organizations running affected versions should track the GitHub Repository for jfinal_cms for upstream fixes and consider migrating to an actively maintained content management platform.

Workarounds

Modify the source of AdvicefeedbackController.java to validate the orderBy parameter against a hardcoded allow-list of permitted column names
Place the application behind a reverse proxy that strips or rejects requests containing SQL keywords in sort parameters
Use a least-privileged database account for the application so that injected queries cannot read sensitive tables or modify schema
Enable query logging at the database layer to support post-incident forensics until a vendor fix is published

bash

# Example WAF/nginx rule to block suspicious orderBy values
if ($arg_orderBy ~* "(select|union|sleep|benchmark|--|;|/\*)") {
    return 403;
}