Skip to content
Threat Feed
Subscribe
low advisory

Jeecg-Boot: Unauthenticated SQL Injection (CVE-2023-1454)

Jeecg-Boot version 3.5.0 contains an unauthenticated SQL injection vulnerability in the /jmreport/qurestSql endpoint, enabling remote attackers to execute error-based SQL queries and disclose sensitive database information.

CVE search metadata

CVE search record: CVE-2023-1454. Severity: medium. CVSS: 6.3. EPSS: 36.07%. KEV: no. Product: Jeecg-Boot (3.5.0). Brief: Jeecg-Boot: Unauthenticated SQL Injection (CVE-2023-1454). Brief link: https://feed.craftedsignal.io/briefs/2026-10-jeecg-boot-sqli/

Triage facts

Revision 1
Applicability
Jeecg-Boot (3.5.0)
Evidence
Unknown
Severity
Low
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Oct 30, 16:51 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
B2Likely

Jeecg-Boot version 3.5.0 is vulnerable to an unauthenticated SQL injection via the /jmreport/qurestSql endpoint. The vulnerability is caused by improper sanitization of the id parameter within the JSON request body. An attacker can exploit this flaw by sending a crafted POST request to the aforementioned path, potentially resulting in unauthorized sensitive data exposure via error-based SQL injection.

Impact

Successful exploitation allows an unauthenticated remote attacker to perform error-based SQL injection, leading to the unauthorized disclosure of database contents.

Recommendation

  • Inventory all internet-facing instances of Jeecg-Boot to identify version 3.5.0 deployments.
  • Apply security patches or update Jeecg-Boot to a non-vulnerable version immediately.
  • Implement Web Application Firewall (WAF) rules to inspect and block POST requests to /jmreport/qurestSql containing SQL metacharacters (e.g., OR, AND, updatexml, concat, like) in the id parameter.

Immediate actions

Inventory and patch all instances of Jeecg-Boot v3.5.0

IT Operations 48h

Threat Hunt

Review web logs for POST requests to /jmreport/qurestSql containing SQL syntax

T1190 high high confidence hunt now

Data: Web server access logs

Mitigations

Implement WAF filtering for malicious SQL injection strings on the /jmreport/qurestSql path

immediate SOC

CVE-2023-1454

Detection coverage 1

Detects CVE-2023-1454 Exploitation - SQL Injection in /jmreport/qurestSql

critical

Detects attempts to exploit CVE-2023-1454 by identifying POST requests to the jmreport/qurestSql endpoint with characteristic SQL injection syntax in the JSON request body.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →