Jeecg-Boot SQL Injection Vulnerability (CNVD-2023-70070)

2023-09-1200:00:00

China National Vulnerability Database

www.cnvd.org.cn

jeecg-boot

sql injection

vulnerability

validation

sql commands

database

cnvd-2023-70070

0.001 Low

EPSS

Percentile

33.0%

JSON

Jeecg-Boot is a low-code platform based on a code generator. A SQL injection vulnerability exists in Jeecg-Boot v3.5.3 and earlier versions, which stems from a lack of validation of externally entered SQL statements in the component /jeecg-boot/jmreport/show. An attacker can exploit this vulnerability to execute illegal SQL commands to steal sensitive database data.

CPENameOperatorVersion
jeecg jeecg_bootle3.5.3

CPE	Name	Operator	Version
	jeecg jeecg_boot	le	3.5.3

0.001 Low

EPSS

Percentile

33.0%

JSON

Related for CNVD-2023-70070