Impact

Successful exploitation results in the permanent deletion of system audit logs, which directly impacts an organization's ability to monitor user activity and perform incident response. By clearing the sys_log table, an attacker can hide evidence of other malicious activities, complicating post-incident forensic analysis. This vulnerability affects all environments running vulnerable versions of JeecgBoot that are exposed to low-privileged users.

Recommendation

• Upgrade all JeecgBoot instances to a patched version that enforces authorization checks on the SysLogController deleteBatch handler.
• Implement strict access controls for web application endpoints to ensure that delete operations are restricted to authorized administrative roles.
• Review existing audit logs for suspicious activity involving the SysLogController, particularly patterns involving the deletion of large volumes of records in a single request.