漏洞关键信息 标题: JeecgBoot 3.9.0 Improper Control of Resource Identifiers 描述: JeecgBoot Tenant Privilege Escalation: GET /sys/sysDepartRole/datarule/{permissionId}/{departId}/{roleId} Data Rule Query Without Tenant Validation 贡献者: huangweigang 影响范围 产品: JeecgBoot (最新版本) GitHub: https://github.com/jeecgboot/jeecg-boot 漏洞终端 请求方法: GET /sys/sysDepartRole/datarule/{permissionId}/{departId}/{roleId} (Query Data Rule Information API) 代码分析 控制器: jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysDepartRoleController.java 路由与方法: - - 关键代码 (236-260): - 查询授权的部门规则 - - 如果 为空，返回错误信息 "Permission configuration information not found"