jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report component.
Use the system default account password to log in to the system.
In the visual design menu - report design, see Figure 1 for details.
<img width="1512" alt="截屏2023-01-29 22 01 08" src="https://user-images.githubusercontent.com/32299945/215331278-68f86a40-1199-463a-b0f0-5441746c7eb1.png">
Then click New Report, see Figure 2 for details.
<img width="1512" alt="截屏2023-01-29 22 03 48" src="https://user-images.githubusercontent.com/32299945/215331465-bb6f1bdf-d5c1-4c6a-a952-e34b2fd540ac.png">
Click the + sign to select a new SQL data set, see Figure 3 for details.
<img width="1512" alt="截屏2023-01-29 22 07 51" src="https://user-images.githubusercontent.com/32299945/215331861-a06d00f7-f5d4-4bc8-9335-e4731f1b02a5.png">
Select and enter the corresponding data according to Figure 4, the payload is as follows:
<img width="1512" alt="截屏2023-01-29 22 11 59" src="https://user-images.githubusercontent.com/32299945/215332242-94ca42ab-c4a7-4bd1-994f-1e98a42d0ec8.png">
payload:select * from sys_user  WHERE id='' union SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,(select group_concat(SCHEMA_NAME) from information_schema.SCHEMATA)
According to the execution result, all the database information of the mysql server of the system can be obtained, see Figure 5 for details.
<img width="1512" alt="截屏2023-01-29 22 14 53" src="https://user-images.githubusercontent.com/32299945/215332357-86bd69da-69d3-4e89-9d17-800c30a4ca53.png">
So far the vulnerability has surfaced successfully.
There is a sql injection vulnerability in the jeecg 3.4.4 building block report
This is a GitHub Issue
repo:jeecg-boot
owner:jeecgboot
Title : There is a sql injection vulnerability in the jeecg 3.4.4 building block report
Issue date:

--- start body ---
Use the system default account password to log in to the system.
In the visual design menu - report design, see Figure 1 for details.
<img width="1512" alt="截屏2023-01-29 22 01 08" src="https://user-images.githubusercontent.com/32299945/215331278-68f86a40-1199-463a-b0f0-5441746c7eb1.png">
Then click New Report, see Figure 2 for details.
<img width="1512" alt="截屏2023-01-29 22 03 48" src="https://user-images.githubusercontent.com/32299945/215331465-bb6f1bdf-d5c1-4c6a-a952-e34b2fd540ac.png">
Click the + sign to select a new SQL data set, see Figure 3 for details.
<img width="1512" alt="截屏2023-01-29 22 07 51" src="https://user-images.githubusercontent.com/32299945/215331861-a06d00f7-f5d4-4bc8-9335-e4731f1b02a5.png">
Select and enter the corresponding data according to Figure 4, the payload is as follows:
<img width="1512" alt="截屏2023-01-29 22 11 59" src="https://user-images.githubusercontent.com/32299945/215332242-94ca42ab-c4a7-4bd1-994f-1e98a42d0ec8.png">
payload:select * from sys_user  WHERE id='' union SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,(select group_concat(SCHEMA_NAME) from information_schema.SCHEMATA)
According to the execution result, all the database information of the mysql server of the system can be obtained, see Figure 5 for details.
<img width="1512" alt="截屏2023-01-29 22 14 53" src="https://user-images.githubusercontent.com/32299945/215332357-86bd69da-69d3-4e89-9d17-800c30a4ca53.png">
So far the vulnerability has surfaced successfully.
--- end body ---

A SQL injection vulnerability exists in the Jeecg 3.4.4 building block report feature. An attacker can exploit this vulnerability by injecting malicious SQL code into the report design interface, allowing them to execute arbitrary SQL queries. This can lead to unauthorized access to sensitive database information, including user data and schema details. The provided payload demonstrates the ability to retrieve all database names from the MySQL server, indicating a serious security risk.