GeetestLib 存在未编码用户输入导致的 HTTP 参数注入漏洞 (CWE-74)

Module: xmall-common

Core class: cn.exrick.common.utils.GeetestLib

Problem description:

Core problem: In the Geetest secondary verification logic, the enhencedValidateRequest method directly concatenates user-controlled inputs (the properties in challenge, validate, seccode, and the data Map) into the POST request body through String.format.

Since the system does not URL encode these parameters, attackers can construct special characters (such as & and =) in the input, inject additional parameters into the downstream request sent to the Geetest server, or tamper with the original parameter logic.