Vulnerability · Published Mar 17, 2023 · Assigned by VulDB

CVE-2023-1454jeecg-boot qurestSql sql injection

Medium 6.3

In plain English

A medium-severity SQL injection in jeecg-boot. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 36.1% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)36.1%top 1.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling2Nuclei, Public PoC

Official description

A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223299.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.jeecgframework.boot:jeecg-boot-common	no fix listed	GHSA-j72f-4hgp-3mwc

Affected products (as reported)

Vendor	Product	Versions
n/a	jeecg-boot	3.5.0

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://vuldb.com/?id.223299 vdb-entry, technical-description
https://vuldb.com/?ctiid.223299 signature, permissions-required
https://github.com/J0hnWalker/jeecg-boot-sqli broken-link, exploit