jeecg-boot Sleep Command SysDictMapper.java sql injection

Vulnerability

Overview CVE-2023-1741 is a SQL injection vulnerability found in jeecg-boot version 3.5.0. The flaw resides in the SysDictMapper.java file, specifically within the "Sleep Command Handler" component. The vulnerability stems from improper sanitization of user-supplied input, allowing an attacker to inject arbitrary SQL commands into database queries. [1][2]

Exploitation

The attack can be carried out remotely, without requiring any prior authentication according to the available details. The exploit has been publicly disclosed, increasing the risk of active exploitation. The attacker can send crafted requests to the vulnerable endpoint to trigger SQL injection. [2]

Impact

Successful exploitation could allow an attacker to execute arbitrary SQL statements, potentially leading to unauthorized access to sensitive data, modification of database content, or even full compromise of the underlying database server. [2]

Mitigation

As of the publication date (2023-03-30), no official patch has been confirmed for this specific issue in jeecg-boot 3.5.0. Users are advised to upgrade to the latest version of jeecg-boot (if available) or implement input validation and parameterized queries as a workaround. It is also recommended to monitor the project's repository for security updates. [1]