CVE-2026-112017 Overview
CVE-2026-112017 is a SQL injection vulnerability in JeecgBoot versions prior to 3.9.5. The flaw resides in the SqlInjectionUtil keyword blocklist, which fails to normalize newline characters before matching dangerous SQL tokens. Authenticated attackers can insert newline characters into dictionary and online report SQL fragments to bypass the filter. Exploitation targets endpoints such as /sys/dict/getDictItems, enabling boolean-based or time-based blind SQL injection. Successful attacks extract arbitrary database contents, including administrator password hashes stored in the sys_user table. The weakness is tracked as [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated attackers can bypass JeecgBoot's SQL injection filter using newline-separated payloads and exfiltrate administrator password hashes from the sys_user table.
Affected Products
- JeecgBoot versions before 3.9.5
- jeecg-boot-base-core module containing SqlInjectionUtil
- Dictionary and online report components exposing /sys/dict/getDictItems
Discovery Timeline
- 2026-10-18 - CVE-2026-112017 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-112017
Vulnerability Analysis
JeecgBoot relies on SqlInjectionUtil to inspect user-controlled SQL fragments passed into dictionary lookups and online report queries. The utility scans input against a static blocklist of SQL keywords and operators. The matching logic treats the input as a single-line token sequence and does not canonicalize whitespace. When attackers insert newline characters between keyword fragments, the blocklist fails to recognize the dangerous tokens. The sanitized input is then concatenated into dynamic SQL and executed against the backing database.
Authenticated users can reach the vulnerable endpoints with a low-privilege session, which satisfies the network attack vector and the authentication requirement reflected in the CVSS metrics. Exploitation yields confidentiality impact on the database contents without requiring user interaction.
Root Cause
The root cause is incomplete input neutralization in SqlInjectionUtil (see the pre-patch code at lines 269-305 of the v3.9.2 source). The blocklist comparison does not strip or collapse newline (\n, \r) characters before matching. Payloads such as uni\non sel\nect evade keyword detection while remaining syntactically valid to the SQL parser after fragment concatenation.
Attack Vector
An authenticated attacker submits crafted parameters to dictionary endpoints such as /sys/dict/getDictItems or online report query interfaces. The attacker splits reserved words with newline characters inside the SQL fragment parameters. The server passes the fragment through SqlInjectionUtil, which fails to flag the payload. The composed SQL executes, returning boolean or time-based signals that leak row data. Iterated requests extract rows from sys_user, including administrator password hashes.
No verified exploit code is published in the referenced advisories. Technical details are available in the VulnCheck Advisory on JeecgBoot and the SqlInjectionUtil Code Review.
Detection Methods for CVE-2026-112017
Indicators of Compromise
- HTTP requests to /sys/dict/getDictItems or online report endpoints containing URL-encoded newline sequences (%0A, %0D) within SQL fragment parameters.
- Application logs showing dynamic SQL statements with embedded line breaks between SQL keywords such as UNION, SELECT, FROM, or WHERE.
- Repeated authenticated requests from a single session producing time-delayed responses consistent with time-based blind injection.
- Database audit entries showing unexpected reads against the sys_user table from the JeecgBoot application account.
Detection Strategies
- Deploy a web application firewall rule that normalizes whitespace in request parameters before SQL keyword matching.
- Instrument application-layer logging to capture the full SQL string generated by dictionary and report components, then alert on multi-line statements.
- Correlate authenticated session IDs with high-volume requests to /sys/dict/* endpoints returning variable response times.
Monitoring Recommendations
- Enable verbose SQL audit logging on the JeecgBoot database user and forward events to a centralized analytics platform.
- Monitor for anomalous SELECT activity against sys_user, sys_permission, and related authentication tables.
- Track outbound data volumes from the application server to detect staged exfiltration of hash material.
How to Mitigate CVE-2026-112017
Immediate Actions Required
- Upgrade JeecgBoot to version 3.9.5 or later using the JeecgBoot Release v3.9.5 artifacts.
- Rotate all administrator and service account credentials stored in sys_user, assuming prior compromise if logs are unavailable.
- Restrict access to /sys/dict/getDictItems and online report endpoints to trusted internal networks until the patch is deployed.
- Review authentication logs for suspicious low-privilege account creation or lateral access to administrator accounts.
Patch Information
The fix is delivered in JeecgBoot 3.9.5. The upstream commit a2be896f753936956ee6863b632b8e5a0231345c includes dependency updates and build-tree changes shipped with the release. Additional context is tracked in JeecgBoot Issue Tracker #9677.
The following excerpt from the release commit shows build hygiene changes bundled with the 3.9.5 security release:
# Git
.git/
.gitignore
.gitmodules
# Maven / Gradle build output
target/
build/
!.mvn/wrapper/maven-wrapper.jar
Source: JeecgBoot Commit Update
The commit also migrates the Oracle JDBC driver, reflecting the broader dependency maintenance included with the release:
- <groupId>com.oracle</groupId>
- <artifactId>ojdbc6</artifactId>
- <version>${ojdbc6.version}</version>
+ <groupId>com.oracle.database.jdbc</groupId>
+ <artifactId>ojdbc11</artifactId>
+ <version>${ojdbc11.version}</version>
Source: JeecgBoot Commit Update
Workarounds
- Place a reverse proxy or WAF rule in front of JeecgBoot that strips or rejects \r and \n characters inside SQL fragment parameters.
- Disable or restrict the online report and dictionary modules for users who do not require them.
- Enforce least privilege on the database account used by JeecgBoot so that it cannot read tables outside its functional scope.
# Example nginx rule to reject newline characters in dictionary endpoint parameters
location /sys/dict/ {
if ($args ~* "(%0A|%0D|\n|\r)") {
return 403;
}
proxy_pass http://jeecgboot_backend;
}
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
