CVE-2023-38992
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
Version 3.5.1 of jeecg-boot was found to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to the database, potentially leading to the disclosure of sensitive information.
Recommendation
It is recommended to upgrade to the latest version of jeecg-boot and to validate and sanitize input data in the application.
Other vulnerabilities in jeecg-boot v3.5.1
See all- CVE-2023-34659Critical
Versions 3.5.0 and 3.5.1 of jeecg-boot have a SQL injection vulnerability in the id parameter of the /jeecg-boot/jmreport/show interface.
- CVE-2022-45207Critical
A SQL injection vulnerability was discovered in Jeecg-boot v3.4.3 within the updateNullByEmptyString component. Attackers can exploit this flaw to manipulate database queries.
- CVE-2022-45206Critical
A SQL injection vulnerability was discovered in Jeecg-boot version 3.4.3 via the /sys/duplicate/check component. An attacker can exploit this flaw to execute unauthorized database queries.
- CVE-2023-38905Medium
Version 3.5.0 and earlier of Jeecg-boot contains an SQL injection vulnerability that allows a local attacker to cause a denial of service using functions such as Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE.
- CVE-2022-45210Medium
Jeecg-boot version 3.4.3 was found to contain a SQL injection vulnerability in the /sys/user/deleteRecycleBin component. An attacker can exploit this flaw to manipulate database queries.
- CVE-2022-45208Medium
Jeecg-boot version 3.4.3 was found to contain a SQL injection vulnerability in the /sys/user/putRecycleBin component. An attacker can exploit this flaw to execute unauthorized database queries.
- CVE-2022-45205Medium
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability in the /sys/dict/queryTableData component. An attacker can exploit this flaw to execute unauthorized database queries.
Original NVD description (English source)
jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.