jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report component.
Use the system default account password to log in to the system.
In the visual design menu - report design, see Figure 1 for details.
<img width="1512" alt="截屏2023-01-29 22 01 08" src="https://user-images.githubusercontent.com/32299945/215331278-68f86a40-1199-463a-b0f0-5441746c7eb1.png">
Then click New Report, see Figure 2 for details.
<img width="1512" alt="截屏2023-01-29 22 03 48" src="https://user-images.githubusercontent.com/32299945/215331465-bb6f1bdf-d5c1-4c6a-a952-e34b2fd540ac.png">
Click the + sign to select a new SQL data set, see Figure 3 for details.
<img width="1512" alt="截屏2023-01-29 22 07 51" src="https://user-images.githubusercontent.com/32299945/215331861-a06d00f7-f5d4-4bc8-9335-e4731f1b02a5.png">
Select and enter the corresponding data according to Figure 4, the payload is as follows:
<img width="1512" alt="截屏2023-01-29 22 11 59" src="https://user-images.githubusercontent.com/32299945/215332242-94ca42ab-c4a7-4bd1-994f-1e98a42d0ec8.png">
payload:select * from sys_user  WHERE id='' union SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,(select group_concat(SCHEMA_NAME) from information_schema.SCHEMATA)
According to the execution result, all the database information of the mysql server of the system can be obtained, see Figure 5 for details.
<img width="1512" alt="截屏2023-01-29 22 14 53" src="https://user-images.githubusercontent.com/32299945/215332357-86bd69da-69d3-4e89-9d17-800c30a4ca53.png">
So far the vulnerability has surfaced successfully.
There is a sql injection vulnerability in the jeecg 3.4.4 building block report
This is a GitHub Issue
repo:jeecg-boot
owner:jeecgboot
Title : There is a sql injection vulnerability in the jeecg 3.4.4 building block report
Issue date:

--- start body ---
Use the system default account password to log in to the system.
In the visual design menu - report design, see Figure 1 for details.
<img width="1512" alt="截屏2023-01-29 22 01 08" src="https://user-images.githubusercontent.com/32299945/215331278-68f86a40-1199-463a-b0f0-5441746c7eb1.png">
Then click New Report, see Figure 2 for details.
<img width="1512" alt="截屏2023-01-29 22 03 48" src="https://user-images.githubusercontent.com/32299945/215331465-bb6f1bdf-d5c1-4c6a-a952-e34b2fd540ac.png">
Click the + sign to select a new SQL data set, see Figure 3 for details.
<img width="1512" alt="截屏2023-01-29 22 07 51" src="https://user-images.githubusercontent.com/32299945/215331861-a06d00f7-f5d4-4bc8-9335-e4731f1b02a5.png">
Select and enter the corresponding data according to Figure 4, the payload is as follows:
<img width="1512" alt="截屏2023-01-29 22 11 59" src="https://user-images.githubusercontent.com/32299945/215332242-94ca42ab-c4a7-4bd1-994f-1e98a42d0ec8.png">
payload:select * from sys_user  WHERE id='' union SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,(select group_concat(SCHEMA_NAME) from information_schema.SCHEMATA)
According to the execution result, all the database information of the mysql server of the system can be obtained, see Figure 5 for details.
<img width="1512" alt="截屏2023-01-29 22 14 53" src="https://user-images.githubusercontent.com/32299945/215332357-86bd69da-69d3-4e89-9d17-800c30a4ca53.png">
So far the vulnerability has surfaced successfully.
--- end body ---
