CVE-2023-38992

CRITICALNuclei

SQL injection in jeecg-boot

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2023-38992 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 22, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

org.jeecgframework.boot:jeecg-boot-common

Browse Maven / org.jeecgframework.boot:jeecg-boot-common
GitHub AdvisoryBefore 3.5.3 · Fixed in 3.5.3affected

Nuclei templates

1
ProjectDiscoveryCRITICALJeecg-Boot v3.5.1 - SQL InjectionCVSS 9.8

SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData in jeecg-boot v3.5.1.

Impact

Successful exploitation could lead to unauthorized access to sensitive data.

Remediation

Implement input validation and use parameterized queries to prevent SQL Injection attacks.

WeaknessesCWE-89
Authorsritikchaddha
Template tagscvecve2023jeecgjeecg-bootsqlivuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:jeecg:jeecg_boot:3.5.1:*:*:*:*:*:*:*
Shodan: http.favicon.hash:1380908726
FOFA: icon_hash=1380908726
https://github.com/jeecgboot/jeecg-boot/issues/5173 https://my.oschina.net/jeecg/blog/10107636 https://nvd.nist.gov/vuln/detail/CVE-2023-38992

Source: ProjectDiscovery

References

4