CVE-2026-1746: JeecgBoot 3.9.0 SQL Injection Vulnerability

CVE-2026-1746 Overview

A SQL Injection vulnerability has been identified in JeecgBoot version 3.9.0, affecting the Online Report API component. The vulnerability exists in the /JeecgBoot/sys/api/loadDictItemByKeyword endpoint, where improper sanitization of the keyword parameter allows attackers to inject malicious SQL queries. This flaw enables remote attackers with low-level privileges to manipulate database queries, potentially leading to unauthorized data access, modification, or deletion.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to extract sensitive data, modify database records, or potentially escalate privileges within affected JeecgBoot deployments.

Affected Products

• JeecgBoot 3.9.0
• JeecgBoot Online Report API component
• Systems utilizing the /JeecgBoot/sys/api/loadDictItemByKeyword endpoint

Discovery Timeline

• 2026-02-02 - CVE CVE-2026-1746 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2026-1746

Vulnerability Analysis

This vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), commonly known as injection. The Online Report API in JeecgBoot 3.9.0 fails to properly sanitize user-supplied input in the keyword parameter before incorporating it into SQL queries. When an authenticated user sends a crafted request to the loadDictItemByKeyword endpoint, the unsanitized input is directly concatenated into the SQL query string, allowing attackers to manipulate the query logic.

The vulnerability can be exploited remotely over the network with low attack complexity. While the attacker requires low-level privileges (authenticated access), no user interaction is needed to trigger the exploit. The impact includes potential compromise of data confidentiality, integrity, and availability within the database layer.

Root Cause

The root cause of this vulnerability is insufficient input validation and the lack of parameterized queries in the loadDictItemByKeyword API handler. The keyword argument is directly embedded into SQL statements without proper escaping or the use of prepared statements. This allows specially crafted input containing SQL metacharacters to alter the intended query structure, enabling injection attacks.

Attack Vector

The attack is executed remotely via the network by sending malicious HTTP requests to the vulnerable endpoint. An attacker with valid credentials (low privilege level) can craft a request containing SQL injection payloads in the keyword parameter. The injection occurs when the backend processes the request and executes the tainted SQL query against the database, potentially returning sensitive data or executing unauthorized database operations.

The vulnerability in the loadDictItemByKeyword endpoint allows attackers to inject SQL commands through the keyword parameter. When the API receives a request, it constructs a database query using unsanitized user input. By including SQL metacharacters and additional query clauses, an attacker can modify the query logic to extract data from other tables, bypass authentication checks, or modify database contents. For detailed technical analysis and proof-of-concept information, refer to the VulDB entry and the Yuque Security Document.

Detection Methods for CVE-2026-1746

Indicators of Compromise

• Unusual SQL error messages in application logs indicating query syntax errors
• Unexpected database queries containing UNION SELECT, OR 1=1, or other SQL injection patterns targeting the loadDictItemByKeyword endpoint
• HTTP requests to /JeecgBoot/sys/api/loadDictItemByKeyword containing special characters such as single quotes, semicolons, or SQL keywords in the keyword parameter
• Anomalous data extraction or database modification activities correlated with API access

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in requests to JeecgBoot API endpoints
• Monitor application logs for failed SQL queries or database errors originating from the Online Report API
• Deploy runtime application self-protection (RASP) solutions to detect SQL injection attempts at the application layer
• Utilize database activity monitoring to identify unauthorized or suspicious query patterns

Monitoring Recommendations

• Enable verbose logging for the JeecgBoot application, particularly for API request parameters
• Configure alerts for high volumes of requests to the loadDictItemByKeyword endpoint
• Monitor database audit logs for queries with injection patterns or unexpected data access
• Implement network traffic analysis to detect anomalous HTTP request patterns targeting the vulnerable endpoint

How to Mitigate CVE-2026-1746

Immediate Actions Required

• Restrict access to the /JeecgBoot/sys/api/loadDictItemByKeyword endpoint using network-level controls or application firewall rules
• Implement input validation on the keyword parameter to reject requests containing SQL metacharacters
• Apply the principle of least privilege to database accounts used by the JeecgBoot application
• Monitor for exploitation attempts while awaiting an official patch from the vendor

Patch Information

As of the last update, the vendor (JeecgBoot) was contacted about this disclosure but did not respond. No official patch is currently available. Organizations should implement workarounds and monitor for vendor security advisories. For the latest information, refer to the VulDB Critical Threat Analysis.

Workarounds

• Deploy a Web Application Firewall (WAF) with SQL injection detection rules in front of the JeecgBoot application
• Implement custom input validation to sanitize the keyword parameter, blocking SQL metacharacters and keywords
• Consider disabling or restricting access to the Online Report API functionality if not business-critical
• Apply database-level query restrictions to limit the scope of potential SQL injection impact

# Example WAF rule for ModSecurity to block SQL injection attempts
SecRule ARGS:keyword "@detectSQLi" \
    "id:100001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'SQL Injection attempt detected in keyword parameter',\
    tag:'CVE-2026-1746'"