Pear-Admin-Boot <=2.0.2 background /loadDictItem interface SQL injection

Vulnerability Product:Pear Admin Boot
Vulnerability version:<=2.0.2
Vulnerability type:sql injection
Vulnerability Details：

1. First, in com/pearadmin/modules/sys/mapper/xml/SysDictDataMapper.xml, we found that ${} was used to pass in the three parameters of text, code, and table, so there was SQL injection. Now let's find out how to pass the parameters.
![输入图片说明](https://foruda.gitee.com/images/1718357509641408589/9094ce79_13737655.png "屏幕截图")

2. In com/pearadmin/modules/sys/mapper/SysDictDataMapper.java:62, we found the queryTableDictByKeys method declared. Now let’s find where this method is called again.
![输入图片说明](https://foruda.gitee.com/images/1718357589569227613/4118e088_13737655.png "屏幕截图")

3. Find the method call in com/pearadmin/modules/sys/service/impl/SysDictDataServiceImpl.java:101, and then look up
![输入图片说明](https://foruda.gitee.com/images/1718357610731591409/601b5528_13737655.png "屏幕截图")

4. Next, we found that the queryTableDictByKeys method was called in com/pearadmin/modules/sys/controller/SysDictDataController.java:127. The text, code, and table variables can be assigned values through the /system/dictData/loadDictItem/{{dictCode}} interface, and the parameter values are passed in through the path.
![输入图片说明](https://foruda.gitee.com/images/1718357630868937178/aa2fa34d_13737655.png "屏幕截图")

5. Finally, our payload is as follows

```
http://localhost:8088/system/dictData/loadDictItem/sys_user,user(),1?key=1
```
![输入图片说明](https://foruda.gitee.com/images/1718357670826691544/ef31545b_13737655.png "屏幕截图")

Pear Admin/Pear Admin Boot

内容风险标识

评论 (2)

Pear Admin/Pear Admin Boot .gitee-modal { width: 500px !important; }

内容风险标识