CVE-2023-38905: Jeecg-boot SQL Injection vulnerability

The vulnerability stems from two key points: 1) The duplicate check endpoint constructs SQL queries using unsanitized user input parameters (tableName/fieldName). 2) The SQL injection filter fails to account for encoded whitespace and specific time-delay functions. The provided PoC shows successful exploitation via sleep(10) with %09 encoding, demonstrating that the filter's regex patterns (XSS_STR) and case conversion don't properly neutralize the threat vectors mentioned in the CVE (Benchmark, PG_Sleep, etc.). The vulnerable functions directly process attacker-controlled inputs that flow into SQL execution contexts.