The vulnerability exists in JeecgBoot versions prior to 3.9.5 and allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into dictionary and online report SQL fragments. This flaw is a classic SQL injection vulnerability (CWE‑89). By sending newline‑separated payloads to endpoints such as /sys/dict/getDictItems, attackers can conduct boolean or time‑based blind injection and extract database contents, including administrator password hashes from the sys_user table.

Affected systems are all releases of JeecgBoot before version 3.9.5. Users who possess authentication credentials for the application can exercise the exploit.

The CVSS score of 7.1 indicates a moderate‑to‑high severity vulnerability, and though no EPSS score is available and it is not listed in CISA’s KEV catalog, authenticated attackers can craft malicious payloads to disclose confidential data. The attack requires only an authenticated session and the ability to send crafted requests, making it realistic against targeted systems that allow user entry to the vulnerable endpoints. Prompt remediations are recommended to prevent potential data compromise.