CVE-2023-38905: 
Java vulnerability analysis and mitigation

SQL injection vulnerability affects Jeecg-boot version 3.5.0 and earlier versions, discovered and disclosed on August 17, 2023. The vulnerability exists in the '/sys/duplicate/check' API endpoint, allowing local attackers to perform SQL injection attacks through specific functions like Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE (NVD).

The vulnerability involves a time-based blind SQL injection flaw within the '/sys/duplicate/check' API endpoint. Attackers can exploit this by utilizing '%09' encoding to replace space characters and leveraging the sleep() function to perform time-delayed SQL injections. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD, GitHub POC).

The successful exploitation of this vulnerability could allow attackers to cause a denial of service condition in the affected system. The attack can potentially compromise the application's database security and integrity through SQL injection techniques (NVD).

The vulnerability has been addressed in the project's GitHub repository issue #4737. Users are advised to upgrade to versions after 3.5.0 which contain the security fix (GitHub Issue).