GitHub Advisoryadvisory · Maven

GHSA-j72f-4hgp-3mwc jeecg-boot SQL Injection vulnerability

CRITICAL Published 2023-03-17 Modified 2023-03-23 Official page ↗
Aliases
CVE-2023-1454
Ecosystem
Maven
Packages
org.jeecgframework.boot:jeecg-boot-common
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2023-03-23

Affected packages

• Maven org.jeecgframework.boot:jeecg-boot-common: <= 3.5.0 (no fix yet)

Description

A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223299.

Related

Alias · CVE (1)

  • CVE-2023-1454 A vulnerability classified as critical has been found in jeecg-boot 3.5.0. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References