Cboard v.0.4.2 and before contains a SQL Injection vulnerability in the /cboard/dashboard/getDimensionValues.do endpoint.
This interface allows users to submit SQL query configurations. During processes including data source testing, field retrieval, dimension value querying, and aggregation querying, the backend directly concatenates SQL statements using user-supplied SQL or column name expressions and executes them via JDBC Statement.executeQuery().
Without parameterized queries in place and lacking effective allowlist validation for SQL structures and column name expressions, authenticated attackers can craft malicious SQL to perform arbitrary queries against the backend data source or bypass logical conditions.
Tested endpoint: /cboard/dashboard/getDimensionValues.do
Test payload (URL-encoded):
datasourceId=1&query={"sql":"SELECT 9 AS A"}&colmunName=A*2
The backend computes and returns the result 18. This output verifies that the expression A*2 inside the colmunName parameter is concatenated into the final SQL statement and executed by the database, instead of being treated as a plain string. Attackers can abuse this vulnerability to extract sensitive data stored in the database.