MCMS SQL Injection in Category List

The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection.

The size parameter is directly concatenated into the LIMIT clause of SQL through FreeMarker ${size} without being parameterized and bound.

The built-in SqlInjectionUtil employs regular expression blacklist filtering, yet keywords like CREATE/TABLE/SET/PREPARE/EXECUTE are not included in the list, allowing for bypassing.

Attackers can execute stacked SQL statements without logging in.