A critical SQL injection vulnerability in Tipray Data Leakage Prevention System 1.0 exposes backend databases to unauthorized access and potential data exfiltration.

The application is vulnerable to SQL injection via the sort parameter in the findUserPage method within the findUserPage.do interface. The software fails to properly sanitize user-supplied input, leading to direct concatenation of malicious SQL queries into database commands.

Successful exploitation allows an attacker to manipulate database queries, potentially leading to the unauthorized disclosure of sensitive enterprise data, credential theft, or modification of business-critical information. Given the CVSS score of 7.3, this flaw presents a high risk to organizational confidentiality and integrity. The potential for unauthorized access to data protected by a leakage prevention system undermines the core security purpose of the platform.

Immediate Action: Since no official patch is currently available from the vendor, administrators should restrict access to the affected interface at the network level and contact Tipray for urgent support. Developers should transition from insecure MyBatis ${} syntax to secure #{} parameter binding in all mapper files.

Proactive Monitoring: Review application access logs for unusual HTTP requests targeting findUserPage.do, specifically looking for payloads containing SQL keywords like SLEEP, AND, or UNION. Monitor database performance for unexpected latency spikes that may indicate time-based blind SQL injection attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming requests containing suspicious SQL syntax within the sort parameter. Ensure that the application runs with the minimum database privileges necessary to limit the impact of a potential compromise.

Public Exploit Available: Yes, a functional proof-of-concept exists as detailed in the security research write-up by FightingLzn9.

The presence of a public proof-of-concept for this SQL injection vulnerability necessitates immediate defensive action. Organizations utilizing Tipray Data Leakage Prevention System must prioritize blocking access to the vulnerable interface and applying stringent input validation controls until a vendor-supplied update is available.