CVE-2026-2822: Jeecg Boot SQL Injection Vulnerability

CVE-2026-2822 Overview

A SQL injection vulnerability has been identified in JeecgBoot versions up to 3.9.1. The vulnerability exists in the Backend Interface component, specifically within the /jeecgboot/sys/dict/loadDict/airag_app,1,create_by endpoint. By manipulating the keyword argument, an attacker can inject malicious SQL commands that are executed by the backend database. This vulnerability can be exploited remotely by authenticated users, and proof-of-concept exploit code has been publicly disclosed.

Critical Impact

Remote SQL injection allows attackers to read, modify, or delete database contents, potentially leading to data breach, unauthorized access to sensitive information, and compromise of application integrity.

Affected Products

• JeecgBoot versions up to and including 3.9.1
• Jeecg Jeecg Boot (all affected versions)

Discovery Timeline

• 2026-02-20 - CVE-2026-2822 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2026-2822

Vulnerability Analysis

This vulnerability is classified as SQL Injection (CWE-89) with an underlying Injection vulnerability (CWE-74). The flaw occurs in the dictionary loading functionality of JeecgBoot's backend interface. When the application processes the keyword parameter in the affected endpoint, it fails to properly sanitize or parameterize user-supplied input before incorporating it into SQL queries.

The vulnerability enables authenticated remote attackers to inject arbitrary SQL statements into database queries. Successful exploitation could allow attackers to extract sensitive data from the database, modify or delete existing records, and potentially escalate privileges within the application. The exploit has been publicly disclosed, increasing the risk of active exploitation in the wild.

Root Cause

The root cause of this vulnerability is insufficient input validation and the lack of parameterized queries in the /jeecgboot/sys/dict/loadDict/airag_app,1,create_by endpoint. The keyword argument is directly concatenated into SQL statements without proper sanitization or the use of prepared statements, allowing specially crafted input to modify the intended SQL query structure.

Attack Vector

The attack can be executed remotely over the network. An authenticated attacker can send specially crafted HTTP requests to the vulnerable endpoint, injecting malicious SQL payloads through the keyword parameter. The vulnerability requires low privileges and no user interaction, making it relatively easy to exploit once an attacker has authenticated access to the application.

The exploitation technique involves crafting malicious input in the keyword parameter that escapes the intended query context. Attackers may use techniques such as UNION-based injection, Boolean-based blind injection, or time-based blind injection to extract data or manipulate database operations. For technical details on the exploitation methodology, refer to the Yuque Security Analysis documentation.

Detection Methods for CVE-2026-2822

Indicators of Compromise

• Unusual HTTP requests to /jeecgboot/sys/dict/loadDict/airag_app,1,create_by containing SQL syntax characters such as single quotes, semicolons, or SQL keywords
• Database error messages in application logs indicating malformed SQL queries
• Unexpected database queries or query patterns in database audit logs
• Evidence of data exfiltration or unauthorized data access in database transaction logs

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in requests to JeecgBoot endpoints
• Monitor application logs for requests containing suspicious keyword parameter values with SQL metacharacters
• Deploy database activity monitoring to detect anomalous query patterns or unexpected UNION, SELECT, or INSERT statements
• Configure alerting for HTTP 500 errors or database connection errors that may indicate exploitation attempts

Monitoring Recommendations

• Enable detailed logging for all requests to the /jeecgboot/sys/dict/loadDict/ path
• Set up real-time alerting for requests containing common SQL injection payloads
• Monitor database query execution times for anomalies that may indicate time-based blind SQL injection attacks
• Review access logs regularly for patterns of reconnaissance activity targeting dictionary loading endpoints

How to Mitigate CVE-2026-2822

Immediate Actions Required

• Upgrade JeecgBoot to a version newer than 3.9.1 if a patch is available
• Implement input validation and parameterized queries for the affected endpoint as a code-level fix
• Deploy WAF rules to block SQL injection attempts targeting the vulnerable endpoint
• Restrict access to the backend interface to trusted IP addresses or networks where possible
• Audit database access and review logs for evidence of prior exploitation

Patch Information

No official vendor patch information is currently available in the CVE data. Organizations should monitor the JeecgBoot project for security updates and apply patches as soon as they become available. For the latest information, refer to VulDB Entry #346947 which tracks this vulnerability.

Workarounds

• Implement a Web Application Firewall with rules to detect and block SQL injection patterns in the keyword parameter
• Apply input validation at the application level to sanitize or reject requests containing SQL metacharacters
• Consider disabling or restricting access to the /jeecgboot/sys/dict/loadDict/ endpoint until a patch is applied
• Use database account permissions to limit the impact of SQL injection by applying the principle of least privilege

# Example WAF rule configuration (ModSecurity)
# Block SQL injection patterns in keyword parameter
SecRule ARGS:keyword "@detectSQLi" \
    "id:100001,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'SQL Injection attempt detected in JeecgBoot keyword parameter',\
    tag:'CVE-2026-2822'"