The vulnerability is explicitly tied to the /sys/user/queryUserComponentData endpoint and the 'code' parameter. In typical Spring Boot architectures, this endpoint would map to a controller method (e.g., SysUserController.queryUserComponentData). SQL injection occurs when user-supplied input (the 'code' parameter) is directly interpolated into SQL queries. The lack of sanitization or use of prepared statements in this function aligns with the described CWE-89 vulnerability. While the exact code is unavailable, the endpoint structure and parameter-specific exploitation vector strongly indicate this controller method as the vulnerable component.