Cpe:2.3:a:jeecg:jeecg_boot:3.5.0:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ajeecgjeecg_boot3.5.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 16:51:50 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgJeecg-Boot: Unauthenticated SQL Injection (CVE-2023-1454)https://feed.craftedsignal.io/briefs/2026-10-jeecg-boot-sqli/Fri, 30 Oct 2026 16:51:50 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-jeecg-boot-sqli/Jeecg-Boot version 3.5.0 contains an unauthenticated SQL injection vulnerability in the /jmreport/qurestSql endpoint, enabling remote attackers to execute error-based SQL queries and disclose sensitive database information.Jeecg-Boot version 3.5.0 is vulnerable to an unauthenticated SQL injection via the /jmreport/qurestSql endpoint. The vulnerability is caused by improper sanitization of the id parameter within the JSON request body. An attacker can exploit this flaw by sending a crafted POST request to the aforementioned path, potentially resulting in unauthorized sensitive data exposure via error-based SQL injection.

Impact

Successful exploitation allows an unauthenticated remote attacker to perform error-based SQL injection, leading to the unauthorized disclosure of database contents.

Recommendation

  • Inventory all internet-facing instances of Jeecg-Boot to identify version 3.5.0 deployments.
  • Apply security patches or update Jeecg-Boot to a non-vulnerable version immediately.
  • Implement Web Application Firewall (WAF) rules to inspect and block POST requests to /jmreport/qurestSql containing SQL metacharacters (e.g., OR, AND, updatexml, concat, like) in the id parameter.
]]>lowadvisory