CVE-2026-3672: JeecgBoot SQL Injection Vulnerability

CVE-2026-3672 Overview

A SQL Injection vulnerability has been identified in JeecgBoot, a popular open-source low-code development platform. The vulnerability exists in the isExistSqlInjectKeyword function of the file /jeecg-boot/sys/api/getDictItems. This flaw allows attackers to inject malicious SQL commands through improper input validation, potentially leading to unauthorized data access, modification, or deletion. The vulnerability can be exploited remotely over a network connection by authenticated users.

Critical Impact

Remote attackers with low-level privileges can exploit this SQL injection vulnerability to manipulate database queries, potentially accessing sensitive data, modifying records, or compromising the integrity of the application's backend database.

Affected Products

• JeecgBoot up to version 3.9.1

Discovery Timeline

• 2026-03-07 - CVE-2026-3672 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-3672

Vulnerability Analysis

This SQL Injection vulnerability (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) affects the dictionary items retrieval functionality in JeecgBoot. The isExistSqlInjectKeyword function, which appears to be designed as a security measure to detect SQL injection attempts, contains a flaw that allows malicious SQL commands to bypass the filtering mechanism. The vulnerability is accessible remotely over the network without requiring user interaction beyond initial authentication.

The exploit has been publicly disclosed, increasing the risk of widespread exploitation. Attackers with low-level authentication credentials can leverage this flaw to execute arbitrary SQL commands against the underlying database.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization within the isExistSqlInjectKeyword function. Despite the function's apparent purpose of preventing SQL injection, it fails to properly neutralize special elements before incorporating user-supplied input into SQL queries. This creates an injection point where attackers can insert malicious SQL syntax that gets executed by the database server.

Attack Vector

The attack is performed remotely over a network connection. An authenticated attacker sends crafted requests to the /jeecg-boot/sys/api/getDictItems endpoint containing malicious SQL payloads. These payloads bypass the inadequate SQL injection keyword detection and are executed against the backend database.

The vulnerability allows attackers to:

• Extract sensitive data from the database through UNION-based or error-based SQL injection techniques
• Modify or delete database records
• Potentially escalate privileges within the application
• In some database configurations, execute system commands on the underlying server

Detection Methods for CVE-2026-3672

Indicators of Compromise

• Unusual SQL error messages in application logs related to the /jeecg-boot/sys/api/getDictItems endpoint
• Abnormal database query patterns or execution times from the JeecgBoot application
• Unexpected data modifications or access patterns in database audit logs
• Requests to the getDictItems API containing SQL keywords such as UNION, SELECT, DROP, or encoded variants

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns targeting the affected endpoint
• Monitor application logs for requests containing SQL syntax or encoding patterns in parameters sent to /jeecg-boot/sys/api/getDictItems
• Deploy database activity monitoring to detect anomalous queries originating from the JeecgBoot application
• Configure intrusion detection systems (IDS) with signatures for common SQL injection attack patterns

Monitoring Recommendations

• Enable verbose logging for the JeecgBoot application, particularly for API requests and database interactions
• Set up alerts for multiple failed or malformed requests to dictionary-related endpoints
• Monitor database query logs for suspicious UNION statements, subqueries, or timing-based injection attempts
• Track authentication events and correlate with subsequent API access patterns to identify compromised accounts

How to Mitigate CVE-2026-3672

Immediate Actions Required

• Review and restrict access to the /jeecg-boot/sys/api/getDictItems endpoint to only essential users
• Implement additional input validation layers at the application gateway or reverse proxy level
• Apply network segmentation to limit database access from potentially compromised application servers
• Monitor for exploitation attempts using the detection strategies outlined above

Patch Information

Organizations running JeecgBoot versions up to 3.9.1 are affected by this vulnerability. Users should monitor the official JeecgBoot project for security updates and apply patches as soon as they become available. For the latest security information, refer to the VulDB advisory and the technical documentation for additional details.

Workarounds

• Deploy a Web Application Firewall (WAF) configured with SQL injection detection rules in front of the JeecgBoot application
• Implement parameterized queries or prepared statements at the application code level for the affected function
• Restrict database user permissions for the JeecgBoot application to the minimum required privileges
• Consider disabling or restricting access to the getDictItems API endpoint if not critical for operations until a patch is available

# Example WAF rule configuration (ModSecurity)
# Add SQL injection protection for the affected endpoint
SecRule REQUEST_URI "@contains /jeecg-boot/sys/api/getDictItems" \
    "id:2026001,phase:2,deny,status:403,\
    chain"
SecRule ARGS "@detectSQLi" \
    "msg:'SQL Injection attempt detected on getDictItems endpoint'"