PT-2023-16995 · Unknown · Jeecg-Boot

Last Moooooonster · Published 2023-03-17 · Updated 2026-01-02 · CVE-2023-1454

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions jeecg-boot version 3.5.0

Description A critical vulnerability has been found in jeecg-boot, affecting an unknown part of the file jmreport/qurestSql. The manipulation of the apiSelectId argument leads to sql injection. It is possible to initiate the attack remotely.

Recommendations For jeecg-boot version 3.5.0, as a temporary workaround, consider restricting access to the jmreport/qurestSql file and avoid using the apiSelectId argument until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-1454

GHSA-J72F-4HGP-3MWC

Affected Products

Jeecg-Boot

References · 16

• 🔥 https://github.com/Sweelg/CVE-2023-1454-Jeecg-Boot-qurestSql-SQLvuln · Exploit
• 🔥 https://github.com/padbergpete47/CVE-2023-1454 · Exploit
• 🔥 https://github.com/gobysec/CVE-2023-1454 · Exploit
• 🔥 https://github.com/shad0w0sec/CVE-2023-1454-EXP · Exploit
• 🔥❌ https://github.com/J0hnWalker/jeecg-boot-sqli · Exploit, Deleted
• 🔥❌ https://github.com/MzzdToT/CVE-2023-1454 · Exploit, Deleted
• https://osv.dev/vulnerability/GHSA-j72f-4hgp-3mwc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-1454 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1454 · Security Note
• https://github.com/jeecgboot/jeecg-boot · Note
• https://t.me/cveNotify/147594 · Telegram Post
• https://t.me/cvenotify/46365 · Telegram Post
• https://vuldb.com/?id.223299 · Note
• https://t.me/cibsecurity/60236 · Telegram Post
• https://t.me/cybersecuritytechnologies/8535 · Telegram Post