jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface.

##### 版本号：

JECG3.5.1 And JECG3.5.0

##### 前端版本：vue3版？还是 vue2版？

vue3

##### 问题描述：

After testing, it was found that the id parameter of the/jeecg-boot/jmreport/show interface of jeecg-boot has SQL injection and is unauthorized.

##### 截图&代码：

Download and use https://github.com/jeecgboot/jeecg-boot After the project source code starts,
Entry: "Statistical Report" -->"Example of Building Block Report"
Grab the package and obtain the SQL injection interface. The following figure proves the existence of SQL injection.
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/ff855884-f2d3-4956-9523-2e7895110b71)
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/4a6bbb5d-65d2-434f-b82c-909a2ea5fe8e)

Payload (check MySQL version):
{"id":"961455b47c0b86dc961e90b5893bff05","apiUrl":"","params":"{\"id\":\"1' or '%1%' like (updatexml(0x3a,concat(1,(select database())),1)) or '%%' like '\"}"}
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/64d42d91-b0a7-46cc-8b5d-28adf691cfba)

Payload (view current database):
{"id":"961455b47c0b86dc961e90b5893bff05","apiUrl":"","params":"{\"id\":\"1' or '%1%' like (updatexml(0x3a,concat(1,(select database())),1)) or '%%' like '\"}"}
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/d8b83073-2750-4609-a06f-cf9ae1038eb7)

Source code analysis:
In the org. jeecg. modules. jmreport. descreport. a package, a.java is a controller; When it comes to post requests/jeecg boot/jmreport/show, it will come to this method.
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/748b5925-660e-4b3f-b504-2a06b577347a)

Using burp for contracting
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/481ff5e8-83c5-46fe-a515-eaaf06672d3f)

Then, line 315 passes var3 into jmReportDesignService. show; Let's follow in and take a look.
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/3f4d72cd-c716-4014-9380-5740ab0bd780)
Enter getDataById on line 2122
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/f8b1bed9-90d3-4ef8-ab53-20f9744e7636)
Then on line 248, reportDbDao. selectList was called
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/fa3d8d56-41e9-49cf-b2a5-0f697e40b316)

Entered the JmReportDb class and obtained dbDynSql as: select * from rep_ demo_ gongsi where id='${id}'。 Confirmed as the ID of the splice
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/88ea6175-4922-4099-98af-8aee0d77ebed)

The interface this.reportDbDao. selectListBySql was called at line 468 in the e-class of the org. jeecg. modules. jmreport. descreport. service. a package.
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/a919a3bb-f793-4f48-ae43-4f22170c9b64)

This interface is a MyBatis method that uses @ ResultType and @ Param annotations. DbDynSql called
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/e96a5736-79af-49a8-b268-5b1e18ee5a55)

![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/5bce0deb-1524-4afe-9d63-4a851ac2ad67)

Finally, the database name was obtained through error injection
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/dfbd17db-0669-4b7e-997d-a96bdf001533)


#### 友情提示（为了提高issue处理效率）：

  - 未按格式要求发帖，会被直接删掉;
  - 描述过于简单或模糊，导致无法处理的，会被直接删掉；
  - 请自己初判问题描述是否清楚，是否方便我们调查处理；
  - 针对问题请说明是Online在线功能(需说明用的主题模板)，还是生成的代码功能；

  
Unauthorized SQL injection in Jeecg3.5.0 and 3.5.1
This is a GitHub Issue
repo:jeecg-boot
owner:jeecgboot
Title : Unauthorized SQL injection in Jeecg3.5.0 and 3.5.1
Issue date:

--- start body ---

##### 版本号：

JECG3.5.1 And JECG3.5.0

##### 前端版本：vue3版？还是 vue2版？

vue3

##### 问题描述：

After testing, it was found that the id parameter of the/jeecg-boot/jmreport/show interface of jeecg-boot has SQL injection and is unauthorized.

##### 截图&代码：

Download and use https://github.com/jeecgboot/jeecg-boot After the project source code starts,
Entry: "Statistical Report" -->"Example of Building Block Report"
Grab the package and obtain the SQL injection interface. The following figure proves the existence of SQL injection.
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/ff855884-f2d3-4956-9523-2e7895110b71)
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/4a6bbb5d-65d2-434f-b82c-909a2ea5fe8e)

Payload (check MySQL version):
{"id":"961455b47c0b86dc961e90b5893bff05","apiUrl":"","params":"{\"id\":\"1' or '%1%' like (updatexml(0x3a,concat(1,(select database())),1)) or '%%' like '\"}"}
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/64d42d91-b0a7-46cc-8b5d-28adf691cfba)

Payload (view current database):
{"id":"961455b47c0b86dc961e90b5893bff05","apiUrl":"","params":"{\"id\":\"1' or '%1%' like (updatexml(0x3a,concat(1,(select database())),1)) or '%%' like '\"}"}
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/d8b83073-2750-4609-a06f-cf9ae1038eb7)

Source code analysis:
In the org. jeecg. modules. jmreport. descreport. a package, a.java is a controller; When it comes to post requests/jeecg boot/jmreport/show, it will come to this method.
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/748b5925-660e-4b3f-b504-2a06b577347a)

Using burp for contracting
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/481ff5e8-83c5-46fe-a515-eaaf06672d3f)

Then, line 315 passes var3 into jmReportDesignService. show; Let's follow in and take a look.
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/3f4d72cd-c716-4014-9380-5740ab0bd780)
Enter getDataById on line 2122
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/f8b1bed9-90d3-4ef8-ab53-20f9744e7636)
Then on line 248, reportDbDao. selectList was called
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/fa3d8d56-41e9-49cf-b2a5-0f697e40b316)

Entered the JmReportDb class and obtained dbDynSql as: select * from rep_ demo_ gongsi where id='${id}'。 Confirmed as the ID of the splice
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/88ea6175-4922-4099-98af-8aee0d77ebed)

The interface this.reportDbDao. selectListBySql was called at line 468 in the e-class of the org. jeecg. modules. jmreport. descreport. service. a package.
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/a919a3bb-f793-4f48-ae43-4f22170c9b64)

This interface is a MyBatis method that uses @ ResultType and @ Param annotations. DbDynSql called
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/e96a5736-79af-49a8-b268-5b1e18ee5a55)

![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/5bce0deb-1524-4afe-9d63-4a851ac2ad67)

Finally, the database name was obtained through error injection
![image](https://github.com/jeecgboot/jeecg-boot/assets/104743791/dfbd17db-0669-4b7e-997d-a96bdf001533)


#### 友情提示（为了提高issue处理效率）：

  - 未按格式要求发帖，会被直接删掉;
  - 描述过于简单或模糊，导致无法处理的，会被直接删掉；
  - 请自己初判问题描述是否清楚，是否方便我们调查处理；
  - 针对问题请说明是Online在线功能(需说明用的主题模板)，还是生成的代码功能；

  
--- end body ---
