CVE-2022-45205
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability in the /sys/dict/queryTableData component. An attacker can exploit this flaw to execute unauthorized database queries.
Risk Assessment
The risk involves potential theft, modification, or deletion of database data, leading to a breach of confidentiality and integrity of organizational information.
Recommendation
It is recommended to immediately update Jeecg-boot to the latest version and apply security patches. Additionally, review and secure all API endpoints against SQL injection.
Other vulnerabilities in Jeecg-boot
See all- CVE-2023-38992Critical
Version 3.5.1 of jeecg-boot was found to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.
- CVE-2023-34659Critical
Versions 3.5.0 and 3.5.1 of jeecg-boot have a SQL injection vulnerability in the id parameter of the /jeecg-boot/jmreport/show interface.
- CVE-2022-45207Critical
A SQL injection vulnerability was discovered in Jeecg-boot v3.4.3 within the updateNullByEmptyString component. Attackers can exploit this flaw to manipulate database queries.
- CVE-2022-45206Critical
A SQL injection vulnerability was discovered in Jeecg-boot version 3.4.3 via the /sys/duplicate/check component. An attacker can exploit this flaw to execute unauthorized database queries.
- CVE-2023-38905Medium
Version 3.5.0 and earlier of Jeecg-boot contains an SQL injection vulnerability that allows a local attacker to cause a denial of service using functions such as Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE.
- CVE-2022-45210Medium
Jeecg-boot version 3.4.3 was found to contain a SQL injection vulnerability in the /sys/user/deleteRecycleBin component. An attacker can exploit this flaw to manipulate database queries.
- CVE-2022-45208Medium
Jeecg-boot version 3.4.3 was found to contain a SQL injection vulnerability in the /sys/user/putRecycleBin component. An attacker can exploit this flaw to execute unauthorized database queries.
Original NVD description (English source)
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS