Live › vulnerability › CVE-2026-112017
Go to dashboardJeecgBoot versions before 3.9.5 filter SQL keywords in dictionary and online report fragments, but inserting newline characters gets past that blocklist. A logged-in attacker can send such payloads to endpoints like /sys/dict/getDictItems and extract database contents, including administrator password hashes from sys_user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running JeecgBoot before 3.9.5 with user accounts that can reach the dictionary or online report endpoints. The sources name the dictionary and online report SQL fragments as the exposed path. Teams on 3.9.5 or later, or not running JeecgBoot, can skip it.
No product ranges from the sources yet.
3.9.5; anything earlier is in scope./sys/dict/getDictItems are reachable by user accounts.3.9.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like /sys/dict/getDictItems for boolean or time-based blind injection, extracting database contents including administrator password hashes from sys_user.
This page as .md · .json · in your agent: get_signal("CVE-2026-112017")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.