PT-2025-6007 · Beijing Guoju Information Technology Co. · Jeecg-Boot

Published 2025-02-07 · Updated 2025-02-09 · CVE-2024-57606

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Beijing Guoju Information Technology Co., Ltd JeecgBoot version 3.7.2

Description A SQL injection issue allows a remote attacker to obtain sensitive information via the getTotalData component. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For version 3.7.2, consider disabling the getTotalData component until a patch is available to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

SQL injection

Weakness Enumeration

CWE-200

CWE-89

Related Identifiers

CVE-2024-57606

GHSA-WFPM-QCHC-6CF9

Affected Products

Jeecg-Boot

References · 9

• 🔥 https://github.com/jeecgboot/JeecgBoot/issues/7665 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-57606 · Security Note
• https://osv.dev/vulnerability/GHSA-wfpm-qchc-6cf9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-57606 · Vendor Advisory
• https://twitter.com/bluepinksec/status/1888656340794396972 · Twitter Post
• https://twitter.com/cybercronai/status/1888359734685659282 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1888000630775578950 · Twitter Post
• https://twitter.com/CVEnew/status/1887988003060203855 · Twitter Post
• https://t.me/cvedetector/17528 · Telegram Post