JeeWMS vulnerabilities

A vulnerability was detected in erzhongxmu Jeewms up to 3.7 in the getTreeData function of src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java in the Autocomplete Data Handler component. Manipulation of the searchVal argument results in SQL injection, and the attack can be initiated remotely. The patch is named 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0.

A weakness was identified in JeeWMS up to version 141740afb2ba14d441c82a833d0a418d07ca2d69 in the Boot Actuator Endpoint component in file /base-boot/actuator. Manipulation leads to information disclosure. The attack can be executed remotely, and exploit is publicly available. The vendor did not respond.

Injection vulnerability in JeeWMS (up to 141740afb2ba14d441c82a833d0a418d07ca2d69) in /base-boot/jmreport/testConnection via dbType/dbDriver/dbUrl/dbUsername/dbPassword arguments. Remote attack, exploit public.