JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component queryFilterTableDictInfo at org.jeecg.modules.api.controller.SystemApiController.
##### 版本号：
3.5.1以及之前的所有版本

##### 前端版本：vue3版？还是 vue2版？
vue3版

##### 问题描述：
与问题https://github.com/jeecgboot/jeecg-boot/issues/4983 类似，访问```org.jeecg.modules.api.controller.SystemApiController```类中的```queryFilterTableDictInfo```方法会触发SQL注入，根据需求获取数据库中的关键信息。主要原因还是绕过SQL注入检测方法后，Mybatis中的${XXX}存在SQL注入隐患。

Similar to the issue https://github.com/jeecgboot/jeecg-boot/issues/4983, accessing the ```queryFilterTableDictInfo``` method in the ```org.jeecg.modules.api.controller.SystemApiController``` class will trigger SQL injection, allowing retrieval of critical information from the database based on the requirements. The main reason for this is the SQL injection vulnerability associated with ${XXX} in MyBatis, even after bypassing the SQL injection detection methods.

##### 截图&代码：
**source code:**
![image-20230526120532352](https://github.com/jeecgboot/jeecg-boot/assets/15136865/dfe85888-682e-48f9-8161-b5f0dcd034fc)
![image-20230526120604020](https://github.com/jeecgboot/jeecg-boot/assets/15136865/22cae1e3-2886-40e1-ac9e-04c74a1177c0)
![image-20230526120641234](https://github.com/jeecgboot/jeecg-boot/assets/15136865/c2e20f25-4a59-4a9f-8aa2-789c563ffda8)

**SQL Injection**
URL: http://localhost:8080/jeecg-boot/sys/api/queryFilterTableDictInfo?table=sys_user&text=password as "text", username as "value" from sys_user --&code=username&filterSql=

![image-20230526120444832](https://github.com/jeecgboot/jeecg-boot/assets/15136865/9bf0f420-a8a1-42e1-9682-f51da7d814be)


#### 友情提示（为了提高issue处理效率）：
  - 未按格式要求发帖，会被直接删掉;
  - 描述过于简单或模糊，导致无法处理的，会被直接删掉；
  - 请自己初判问题描述是否清楚，是否方便我们调查处理；
  - 针对问题请说明是Online在线功能(需说明用的主题模板)，还是生成的代码功能；

  

org.jeecg.modules.api.controller.SystemApiController.queryFilterTableDictInfo方法导致SQL注入
This is a GitHub Issue
repo:jeecg-boot
owner:jeecgboot
Title : org.jeecg.modules.api.controller.SystemApiController.queryFilterTableDictInfo方法导致SQL注入
Issue date:

--- start body ---
##### 版本号：
3.5.1以及之前的所有版本

##### 前端版本：vue3版？还是 vue2版？
vue3版

##### 问题描述：
与问题https://github.com/jeecgboot/jeecg-boot/issues/4983 类似，访问```org.jeecg.modules.api.controller.SystemApiController```类中的```queryFilterTableDictInfo```方法会触发SQL注入，根据需求获取数据库中的关键信息。主要原因还是绕过SQL注入检测方法后，Mybatis中的${XXX}存在SQL注入隐患。

Similar to the issue https://github.com/jeecgboot/jeecg-boot/issues/4983, accessing the ```queryFilterTableDictInfo``` method in the ```org.jeecg.modules.api.controller.SystemApiController``` class will trigger SQL injection, allowing retrieval of critical information from the database based on the requirements. The main reason for this is the SQL injection vulnerability associated with ${XXX} in MyBatis, even after bypassing the SQL injection detection methods.

##### 截图&代码：
**source code:**
![image-20230526120532352](https://github.com/jeecgboot/jeecg-boot/assets/15136865/dfe85888-682e-48f9-8161-b5f0dcd034fc)
![image-20230526120604020](https://github.com/jeecgboot/jeecg-boot/assets/15136865/22cae1e3-2886-40e1-ac9e-04c74a1177c0)
![image-20230526120641234](https://github.com/jeecgboot/jeecg-boot/assets/15136865/c2e20f25-4a59-4a9f-8aa2-789c563ffda8)

**SQL Injection**
URL: http://localhost:8080/jeecg-boot/sys/api/queryFilterTableDictInfo?table=sys_user&text=password as "text", username as "value" from sys_user --&code=username&filterSql=

![image-20230526120444832](https://github.com/jeecgboot/jeecg-boot/assets/15136865/9bf0f420-a8a1-42e1-9682-f51da7d814be)


#### 友情提示（为了提高issue处理效率）：
  - 未按格式要求发帖，会被直接删掉;
  - 描述过于简单或模糊，导致无法处理的，会被直接删掉；
  - 请自己初判问题描述是否清楚，是否方便我们调查处理；
  - 针对问题请说明是Online在线功能(需说明用的主题模板)，还是生成的代码功能；

  

--- end body ---

The issue describes a SQL injection vulnerability in the `queryFilterTableDictInfo` method of the `SystemApiController` class in the Jeecg Boot framework. This vulnerability allows attackers to manipulate SQL queries by injecting malicious SQL code through the `text` parameter, which can lead to unauthorized access to sensitive data in the database. The problem arises from the use of MyBatis's `${XXX}` syntax, which does not properly sanitize user input, allowing SQL injection to bypass detection mechanisms.