House-Master is a rental management system built with Spring MVC + MyBatis + MySQL, supporting two roles: landlord (admin) and tenant. It provides features including property management, contract signing, rent payment, and fault reporting.
Multiple MyBatis Mapper XML files use ${} string interpolation instead of #{} parameterized queries for the zuname (tenant name) parameter, resulting in SQL injection vulnerabilities. Since the system has no authentication interceptors configured, an unauthenticated attacker can trigger injection via /paid/selectall.action and /wrong/selectall.action endpoints to extract all sensitive data from the database, including user credentials, tenant ID card numbers, phone numbers, and contract information.
The system uses ${zuname} for string interpolation in LIKE queries within PaidMapper.xml
${} is MyBatis's raw string interpolation mechanism, which directly replaces the parameter value into the SQL statement without any escaping or parameterization. The final SQL executed is：SELECT * FROM paid WHERE name LIKE '%${zuname}%’
The selectall method in the PaidController class passes the parameter into paidService.selectall() via parameter binding.
Following into the implementation class of paidService.selectall() as below:
Continue following into the mapper:
Locate the corresponding XML file by searching for PaidMapper, and trace back to the original SQL injection point via selectall.
Finally, by inspecting the parameter binding, it is confirmed that the zuname parameter is user-controllable.
At this point, the complete parameter passing chain is as follows: The HTTP request parameter zuname is auto-bound by Spring MVC to the QueryVo.zuname field, then passed through PaidController → PaidServiceImpl → PaidMapper to the sink, with no filtering or validation along the way.