CVE-2023-34603

Root

Cause

CVE-2023-34603 describes a SQL injection vulnerability in JeecgBoot, a low-code development platform, affecting versions up to 3.5.1. The flaw resides in the queryFilterTableDictInfo method of the SystemApiController class (package org.jeecg.modules.api.controller). According to the official issue report, the root cause is the use of MyBatis' ${expression} syntax for dynamic SQL parameters, which directly interpolates user input without proper sanitization or parameterization [3]. The application's built-in SQL injection detection can be bypassed, allowing the attacker to inject arbitrary SQL fragments.

Attack

Surface & Exploitation

The vulnerable endpoint is accessible at /sys/api/queryFilterTableDictInfo and accepts parameters such as table, text, code, and filterSql. An unauthenticated or low-privilege attacker can craft a request (e.g., injecting into the text parameter) to modify the query structure. For example, the provided proof-of-concept payload in the GitHub issue uses text=password as "text", username as "value" from sys_user -- to extract credentials from the sys_user table [3]. No special privileges are mentioned as a prerequisite.

Impact

Successful exploitation allows an attacker to retrieve arbitrary data from the underlying database, including sensitive user credentials and other confidential information stored in the application database. This could lead to privilege escalation, data exfiltration, or further compromise of the system. The vulnerability is classified with a CVSS severity that reflects potential high impact on confidentiality [2].

Mitigation

Status

At the time of publication (June 2023), the project maintainers had been notified via the GitHub issue tracker, but no immediate patch was confirmed for versions beyond 3.5.1. Users are advised to upgrade to the latest available version (3.9.2 as of April 2026) and apply input validation and parameterized queries to prevent SQL injection. No known workaround beyond code-level fixes has been documented [1][3].