PT-2025-53640 · Unknown · Jeecg-Boot

Huangweigang · Published 2025-12-28 · Updated 2025-12-28 · CVE-2025-15125

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions JeecgBoot versions up to 3.9.0

Description A security issue exists in JeecgBoot that allows for remote authorization bypass. This is due to improper authorization resulting from the manipulation of the departId argument within the queryDepartPermission function located in the file /sys/permission/queryDepartPermission. The issue is characterized by high complexity and difficult exploitability. The exploit for this issue has been publicly released and may be exploited. The vendor was contacted regarding this disclosure but did not respond.

Recommendations JeecgBoot versions prior to 3.9.0 should be updated. As a temporary workaround, consider restricting access to the /sys/permission/queryDepartPermission file or disabling the queryDepartPermission() function until a patch is available.

Exploit

Fix

Incorrect Authorization

Incorrect Privilege Assignment

Improper Authorization

Weakness Enumeration

CWE-863

CWE-266

CWE-285

Related Identifiers

CVE-2025-15125

Affected Products

Jeecg-Boot

References · 10

• 🔥 https://vuldb.com/?submit.711777 · Exploit
• 🔥 https://github.com/Hwwg/cve/issues/38 · Exploit
• https://osv.dev/vulnerability/CVE-2025-15125 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15125 · Security Note
• https://t.me/cveNotify/146963 · Telegram Post
• https://vuldb.com/?ctiid.338503 · Note
• https://vuldb.com/?id.338503 · Note
• https://twitter.com/CVEnew/status/2005176392590217336 · Twitter Post
• https://t.me/CVEtracker/40761 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2005181050922639837 · Twitter Post