{"id":"CVE-2026-112017","kind":"vulnerability","aliases":["CVE-2026-112017"],"related":[],"title":"JeecgBoot: newline characters bypass SQL keyword filter, enabling blind injection","description":"JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. Attackers can send newline-separated payloads to endpoints like /sys/dict/getDictItems for boolean or time-based blind injection, extracting database contents including administrator password hashes from sys_user.","summary":"JeecgBoot versions before 3.9.5 filter SQL keywords in dictionary and online report fragments, but inserting newline characters gets past that blocklist. A logged-in attacker can send such payloads to endpoints like /sys/dict/getDictItems and extract database contents, including administrator password hashes from sys_user.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","jeecgboot","package","self-hosted","sql"],"not_affected_if":["version-3.9.5-or-later"],"how_to_check":"- Check the installed JeecgBoot version against `3.9.5`; anything earlier is in scope.\n- Confirm whether the dictionary or online report endpoints such as `/sys/dict/getDictItems` are reachable by user accounts.\n- unknown for a specific command or config check beyond the version.","fix":"- Upgrade JeecgBoot to `3.9.5` or later.\n- Rotate administrator and user password hashes and sessions if exposure is suspected.\n- unknown for any workaround beyond upgrading.","status":"open","published_at":"2026-10-18T12:17:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T03:36:06+00:00","updated_at":"2026-10-25T03:36:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:36:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade JeecgBoot to `3.9.5` or later.\n- Rotate administrator and user password hashes and sessions if exposure is suspected.\n- unknown for any workaround beyond upgrading.","reach":"internet","title":"JeecgBoot: newline characters bypass SQL keyword filter, enabling blind injection","impact":"high","summary":"JeecgBoot versions before 3.9.5 filter SQL keywords in dictionary and online report fragments, but inserting newline characters gets past that blocklist. A logged-in attacker can send such payloads to endpoints like /sys/dict/getDictItems and extract database contents, including administrator password hashes from sys_user.","category":"package","nicknames":[],"who_cares":["jeecgboot","self-hosted","java","sql"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads database contents, including administrator password hashes.","analyst_note":"Confirm the affected version range and whether default deployments expose the dictionary endpoint to ordinary authenticated users; the sources give no advisory URL beyond NVD.","how_to_check":"- Check the installed JeecgBoot version against `3.9.5`; anything earlier is in scope.\n- Confirm whether the dictionary or online report endpoints such as `/sys/dict/getDictItems` are reachable by user accounts.\n- unknown for a specific command or config check beyond the version.","needs_analyst":true,"not_affected_if":["version-3.9.5-or-later"],"who_is_affected":"Teams running JeecgBoot before 3.9.5 with user accounts that can reach the dictionary or online report endpoints. The sources name the dictionary and online report SQL fragments as the exposed path. Teams on 3.9.5 or later, or not running JeecgBoot, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00067,"input_tokens":3369,"output_tokens":667,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112017':13A,16A '-2026':12A,15A '/sys/dict/getdictitems':57B,108C '3.9.5':27B,71C 'administr':63B,121C 'allow':78C 'attack':49B,80C,98C 'authent':79C 'base':114C 'blind':9A,115C 'blocklist':44B,86C 'boolean':110C 'bypass':4A,82C 'charact':3A,40B,90C 'contain':72C 'content':61B,119C 'cve':11A,14A 'databas':60B,118C 'dictionari':32B,92C 'enabl':8A 'endpoint':55B,106C 'extract':59B,117C 'filter':7A,28B 'fragment':36B,97C 'get':41B 'hash':65B,123C 'host':22B 'includ':62B,120C 'inject':10A,75C,116C 'insert':38B,88C 'java':17B 'jeecgboot':1A,18B,24B,69C 'keyword':6A,30B,85C 'like':56B,107C 'log':47B 'logged-in':46B 'newlin':2A,39B,89C,102C 'newline-separ':101C 'onlin':34B,94C 'packag':19B 'password':64B,122C 'past':42B 'payload':53B,104C 'report':35B,95C 'self':21B 'self-host':20B 'send':51B,100C 'separ':103C 'sql':5A,23B,29B,74C,96C 'sqlinjectionutil':84C 'sys':67B,125C 'time':113C 'time-bas':112C 'user':68B,126C 'version':25B 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Teams running JeecgBoot before 3.9.5 with user accounts that can reach the dictionary or online report endpoints. The sources name the dictionary and online report SQL fragments as the exposed path. Teams on 3.9.5 or later, or not running JeecgBoot, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T12:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112017","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112017","severity":null,"published_at":"2026-10-18T12:17:14+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}