Description
其中JeecgBoot使用的积木报表组件，在/jmreport/queryFieldBySql 接口存在SQL注入漏洞，由于使用 Freemarker 处理了传入的sql语句，导致可以进行模版注入(SSTI) 执行任意命令。
积木报表 /jmreport/queryFieldBySql 路径存在SSTI命令执行
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.cnblogs.com/pursue-security/p/17665454.html
https://blog.csdn.net/murphysec/article/details/132335872
https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/webapp/JeecgBoot-SSTI-CVE-2023-4450.md
https://juejin.cn/post/7267937496482529337
https://whoopsunix.com/docs/java/named%20module/
https://c0olw.github.io/2023/08/15/JeecgBoot-SSTI%E4%BB%A5%E5%8F%8AJDBC-RCE/
https://blog.certcube.com/jeecgboot-jimureport-ssti-rce-cve-2023-4450/
https://zhi.oscs1024.com/4711.html