CVE-2022-45207

CriticalCVSS 9.8

Published: 25/11/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.91%

56th percentile - higher than 56% of all known CVEs

Summary

A SQL injection vulnerability was discovered in Jeecg-boot v3.4.3 within the updateNullByEmptyString component. Attackers can exploit this flaw to manipulate database queries.

Risk Assessment

The risk involves unauthorized access, modification, or deletion of data, potentially compromising the confidentiality and integrity of the system.

Recommendation

Immediately update Jeecg-boot to the latest version and apply relevant security patches. Review and secure all endpoints using the updateNullByEmptyString component.

Other vulnerabilities in Jeecg-boot

See all

CVE-2023-38992Critical
Version 3.5.1 of jeecg-boot was found to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.
CVE-2023-34659Critical
Versions 3.5.0 and 3.5.1 of jeecg-boot have a SQL injection vulnerability in the id parameter of the /jeecg-boot/jmreport/show interface.
CVE-2022-45206Critical
A SQL injection vulnerability was discovered in Jeecg-boot version 3.4.3 via the /sys/duplicate/check component. An attacker can exploit this flaw to execute unauthorized database queries.
CVE-2023-38905Medium
Version 3.5.0 and earlier of Jeecg-boot contains an SQL injection vulnerability that allows a local attacker to cause a denial of service using functions such as Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE.
CVE-2022-45210Medium
Jeecg-boot version 3.4.3 was found to contain a SQL injection vulnerability in the /sys/user/deleteRecycleBin component. An attacker can exploit this flaw to manipulate database queries.
CVE-2022-45208Medium
Jeecg-boot version 3.4.3 was found to contain a SQL injection vulnerability in the /sys/user/putRecycleBin component. An attacker can exploit this flaw to execute unauthorized database queries.
CVE-2022-45205Medium
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability in the /sys/dict/queryTableData component. An attacker can exploit this flaw to execute unauthorized database queries.

Original NVD description (English source)

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString.