Jfinal CMS vulnerabilities

In jfinal_cms up to version 5.1.0, an SQL injection vulnerability was found in the list function of AdvicefeedbackController.java. Manipulating the orderBy argument allows remote attack. The project was notified but has not responded.

jfinal CMS version 5.1.0 has an arbitrary file read vulnerability.

In Jfinal CMS 5.1.0, improper access control allows attackers to read sensitive information by directly requesting the file /classes/conf/db.properties&config=filemanager.config.js.