SQL Injection Vulnerability in JeecgBoot Affects Data Security

CVE-2026-112017

What is CVE-2026-112017?

JeecgBoot versions prior to 3.9.5 are susceptible to a SQL injection vulnerability that enables authenticated attackers to bypass the SqlInjectionUtil keyword blocklist. By manipulating SQL fragments with newline characters, an attacker can execute malicious SQL statements via endpoints like /sys/dict/getDictItems. This exploitation can lead to the extraction of sensitive database information, including administrator password hashes stored in the sys_user table. Users of JeecgBoot are strongly advised to upgrade to version 3.9.5 or later to mitigate this vulnerability.

References