CVE-2026-11473: SQL Injection in jflyfox jfinal_cms AdvicefeedbackController

Technical summary

CVE-2026-11473 is a SQL injection flaw affecting jflyfox jfinal_cms up to version 5.1.0 in the AdvicefeedbackController.java file. The orderBy parameter in the list function fails to properly sanitize user input before constructing SQL queries (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). This allows an authenticated attacker to inject arbitrary SQL commands, potentially leading to unauthorized data access, modification, or deletion. The vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) as well.

Business impact

This vulnerability could allow authenticated users within your organization—or attackers who have compromised credentials—to extract sensitive data from the CMS database, modify content, or disrupt system availability. If jfinal_cms is used to manage customer-facing content or internal documentation, data confidentiality and integrity are at risk. The medium severity rating reflects the requirement for authentication, but the attack surface remains significant in environments where user accounts are shared or credentials are weak.

Affected systems

jflyfox jfinal_cms versions up to and including 5.1.0 are affected. Organizations running earlier versions are also vulnerable. The project maintainers have not yet released a patch as of the vulnerability publication date; verify the latest available version and vendor advisory for patch status.

Exploitability

Exploitation requires valid authentication credentials (CVSS PR:L) but is otherwise straightforward: an attacker with login access can craft malicious orderBy parameters in list requests to the AdvicefeedbackController. No user interaction, special network access, or complex exploitation steps are needed. The attack vector is network-based and can be automated, making it attractive to insider threats or threat actors who have obtained credentials.

Remediation

Immediately contact jflyfox or monitor their repository for a patched version beyond 5.1.0. Until a patch is available, apply input validation and parameterized query practices to the AdvicefeedbackController. Consider restricting network access to the CMS to trusted networks and enforcing strong authentication policies to reduce the likelihood of credential compromise. Audit database logs for suspicious SQL patterns or unusual query activity.

Patch guidance

Check the official jflyfox jfinal_cms repository and release notes for versions newer than 5.1.0 that address this SQL injection. If the project has not released a patch, consider escalating internally to evaluate alternative CMS solutions or implementing compensating controls. Test any patch thoroughly in a non-production environment before deployment to ensure compatibility with your configuration.

Detection guidance

Monitor web server and application logs for unusual orderBy parameter values, especially those containing SQL keywords (UNION, SELECT, OR, DROP, etc.) or comment sequences (--,/*). Enable SQL query logging at the database layer to detect injected commands. Look for requests to AdvicefeedbackController endpoints originating from unexpected internal users or from outside normal business hours. Implement WAF rules to block common SQL injection patterns in query parameters.

Why prioritize this

While this vulnerability requires authentication and carries a MEDIUM CVSS score (6.3), it should be prioritized for rapid assessment and remediation because: (1) SQL injection poses direct risk to data confidentiality and integrity; (2) jfinal_cms is a content management system likely containing sensitive or high-value data; (3) the patch status remains unclear, leaving affected instances exposed; (4) credential compromise is common in real-world incidents, making the 'requires authentication' assumption less protective in practice.

Risk score, explained

The CVSS 3.1 score of 6.3 (MEDIUM) reflects a network-accessible SQL injection that requires prior authentication, affects confidentiality, integrity, and availability, and does not require privilege escalation. The score is justified but should be elevated in risk prioritization if: your jfinal_cms instance handles payment, healthcare, or personal data; user accounts are numerous or credentials are shared; or historical logging suggests internal account compromise is plausible.

Frequently asked questions