An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: /sys/user/querySysUser?username=admin.
##### 版本号：
<=2.4.5
##### 问题描述：
###### 1. leaks sensitive information api uri: /sys/user/querySysUser?username=admin
![image](https://user-images.githubusercontent.com/15991940/125753825-06d1da62-e1d7-4270-9076-c3802880c76d.png)
 leaks sensitive information such as phone .etc
###### 2. Enumerate usernames  api  uri：/sys/user/checkOnlyUser?username=admin
![image](https://user-images.githubusercontent.com/15991940/125754482-e74d66a7-dbef-48b4-bdf6-4171d55c4001.png)
![image](https://user-images.githubusercontent.com/15991940/125754373-50be8faa-fa0c-40f1-9d96-e95d282d8436.png)
Through enumeration, it is found that there are 2 accounts admin and user1 in the system 

##### 截图&代码：
version：2.4.5
![image](https://user-images.githubusercontent.com/15991940/125754774-0f56c80d-96c7-4204-ab75-b955f64ac20b.png)
![image](https://user-images.githubusercontent.com/15991940/125753825-06d1da62-e1d7-4270-9076-c3802880c76d.png)
![image](https://user-images.githubusercontent.com/15991940/125754482-e74d66a7-dbef-48b4-bdf6-4171d55c4001.png)
![image](https://user-images.githubusercontent.com/15991940/125754373-50be8faa-fa0c-40f1-9d96-e95d282d8436.png)

友情提示： 未按格式要求发帖，会直接删掉。

[2 secueiry issue]jeecg-boot <= 2.4.5 API interface has unauthorized access and leaks sensitive information such as email,phone and Enumerate usernames that exist in the system 
This is a GitHub Issue
repo:jeecg-boot
owner:jeecgboot
Title : [2 secueiry issue]jeecg-boot <= 2.4.5 API interface has unauthorized access and leaks sensitive information such as email,phone and Enumerate usernames that exist in the system 
Issue date:

--- start body ---
##### 版本号：
<=2.4.5
##### 问题描述：
###### 1. leaks sensitive information api uri: /sys/user/querySysUser?username=admin
![image](https://user-images.githubusercontent.com/15991940/125753825-06d1da62-e1d7-4270-9076-c3802880c76d.png)
 leaks sensitive information such as phone .etc
###### 2. Enumerate usernames  api  uri：/sys/user/checkOnlyUser?username=admin
![image](https://user-images.githubusercontent.com/15991940/125754482-e74d66a7-dbef-48b4-bdf6-4171d55c4001.png)
![image](https://user-images.githubusercontent.com/15991940/125754373-50be8faa-fa0c-40f1-9d96-e95d282d8436.png)
Through enumeration, it is found that there are 2 accounts admin and user1 in the system 

##### 截图&代码：
version：2.4.5
![image](https://user-images.githubusercontent.com/15991940/125754774-0f56c80d-96c7-4204-ab75-b955f64ac20b.png)
![image](https://user-images.githubusercontent.com/15991940/125753825-06d1da62-e1d7-4270-9076-c3802880c76d.png)
![image](https://user-images.githubusercontent.com/15991940/125754482-e74d66a7-dbef-48b4-bdf6-4171d55c4001.png)
![image](https://user-images.githubusercontent.com/15991940/125754373-50be8faa-fa0c-40f1-9d96-e95d282d8436.png)

友情提示： 未按格式要求发帖，会直接删掉。

--- end body ---
