CVE-2023-38905
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Version 3.5.0 and earlier of Jeecg-boot contains an SQL injection vulnerability that allows a local attacker to cause a denial of service using functions such as Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE.
Risk Assessment
This vulnerability could lead to significant disruptions in system operation, potentially affecting the availability of services within the organization.
Recommendation
It is recommended to upgrade to the latest version of Jeecg-boot to mitigate this vulnerability and to monitor the system for unauthorized activities.
Other vulnerabilities in Jeecg-boot
See all- CVE-2023-38992Critical
Version 3.5.1 of jeecg-boot was found to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.
- CVE-2023-34659Critical
Versions 3.5.0 and 3.5.1 of jeecg-boot have a SQL injection vulnerability in the id parameter of the /jeecg-boot/jmreport/show interface.
- CVE-2022-45207Critical
A SQL injection vulnerability was discovered in Jeecg-boot v3.4.3 within the updateNullByEmptyString component. Attackers can exploit this flaw to manipulate database queries.
- CVE-2022-45206Critical
A SQL injection vulnerability was discovered in Jeecg-boot version 3.4.3 via the /sys/duplicate/check component. An attacker can exploit this flaw to execute unauthorized database queries.
- CVE-2022-45210Medium
Jeecg-boot version 3.4.3 was found to contain a SQL injection vulnerability in the /sys/user/deleteRecycleBin component. An attacker can exploit this flaw to manipulate database queries.
- CVE-2022-45208Medium
Jeecg-boot version 3.4.3 was found to contain a SQL injection vulnerability in the /sys/user/putRecycleBin component. An attacker can exploit this flaw to execute unauthorized database queries.
- CVE-2022-45205Medium
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability in the /sys/dict/queryTableData component. An attacker can exploit this flaw to execute unauthorized database queries.
Original NVD description (English source)
SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE functions.