1. First, in com/pearadmin/modules/sys/mapper/xml/SysDictDataMapper.xml, we found that ${} was used to pass in the three parameters of text, code, and table, so there was SQL injection. Now let's find out how to pass the parameters.
2. In com/pearadmin/modules/sys/mapper/SysDictDataMapper.java:62, we found the queryTableDictByKeys method declared. Now let’s find where this method is called again.
4. Next, we found that the queryTableDictByKeys method was called in com/pearadmin/modules/sys/controller/SysDictDataController.java:127. The text, code, and table variables can be assigned values through the /system/dictData/loadDictItem/{{dictCode}} interface, and the parameter values are passed in through the path.
