PT-2023-16995 · Unknown · Jeecg-Boot

Last Moooooonster · CVE-2023-1454 · Published 2023-03-17 · Updated 2026-01-02

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions jeecg-boot version 3.5.0

Description A critical vulnerability has been found in jeecg-boot, affecting an unknown part of the file jmreport/qurestSql. The manipulation of the apiSelectId argument leads to sql injection. It is possible to initiate the attack remotely.

Recommendations For jeecg-boot version 3.5.0, as a temporary workaround, consider restricting access to the jmreport/qurestSql file and avoid using the apiSelectId argument until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-1454

GHSA-J72F-4HGP-3MWC

Affected Products

Jeecg-Boot

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1454.json · Exploit
• 🔥 https://github.com/Sweelg/CVE-2023-1454-Jeecg-Boot-qurestSql-SQLvuln · Exploit
• 🔥 https://github.com/padbergpete47/CVE-2023-1454 · Exploit
• 🔥 https://github.com/gobysec/CVE-2023-1454 · Exploit
• 🔥 https://github.com/shad0w0sec/CVE-2023-1454-EXP · Exploit
• 🔥❌ https://github.com/J0hnWalker/jeecg-boot-sqli · Exploit, Deleted
• 🔥❌ https://github.com/MzzdToT/CVE-2023-1454 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2023-1454 · Security Note
• https://osv.dev/vulnerability/GHSA-j72f-4hgp-3mwc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-1454 · Vendor Advisory
• https://github.com/jeecgboot/jeecg-boot · Note
• https://t.me/cibsecurity/60236 · Telegram Post
• https://t.me/cybersecuritytechnologies/8535 · Telegram Post
• https://t.me/cvenotify/46365 · Telegram Post
• https://t.me/cveNotify/147594 · Telegram Post