JeecgBoot EUVD-2026-103470

Requires an authenticated session with at least a low-privilege JeecgBoot account (CVSS PR:L) that can reach the dictionary and online-report query endpoints such as /sys/dict/getDictItems. The specific technical precondition is that SqlInjectionUtil's keyword blocklist (as implemented through v3.9.2) can be evaded by inserting newline characters into user-supplied SQL fragments, so exploitation depends on running an unpatched version before 3.9.5. No special non-default product configuration or user interaction is needed, but the authentication requirement is the primary limiting factor and patched (≥3.9.5) instances are not exploitable.

This is a credible mid-tier priority rather than a drop-everything emergency, and the available signals are internally consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity injection that requires an authenticated low-privilege account (PR:L), and the impact is confined to confidentiality (VC:H / VI:N / VA:N) - consistent with a read-only blind SQL injection that extracts data such as sys_user password hashes but does not inherently modify or destroy data. No EPSS score, CISA KEV listing, SSVC decision, or public POC was provided in the input, so there is no evidence of active or automatable exploitation at this time; the finding was reported by VulnCheck (a credible research source) and a vendor patch exists in v3.9.5. The main risk amplifier is that the required privilege is low - many JeecgBoot deployments issue ordinary user accounts, and the affected endpoints (e.g. /sys/dict/getDictItems) are broadly reachable - so an attacker who obtains or registers any authenticated session could pivot to extracting administrator credentials and escalating. No key signals appear to conflict; the main gap is the absence of exploitation-probability data (EPSS/KEV/POC), which should be treated as 'unknown' rather than 'low'.

An attacker with any valid low-privilege JeecgBoot account sends a request to a dictionary or online-report endpoint such as /sys/dict/getDictItems, embedding newline characters in the SQL fragment to split blocklisted keywords and slip past the SqlInjectionUtil filter. Using boolean- or time-based blind techniques, they iteratively extract database contents, ultimately dumping administrator password hashes from sys_user for offline cracking and privilege escalation. No public exploit code was identified in the provided data, but the vendor advisory and patch commit document the mechanism precisely.