Jeecg Boot SQL injection vulnerability

严重 9.8CVE-2023-41542 · GHSA-5v9r-788c-wc8p · Published 30/12/2023 · updated 17/06/2026

要点

CVE-2023-41542 是影响 org.jeecgframework.boot:jeecg-boot-common, jeecg boot (jeecg) 的严重 (CVSS 9.8)漏洞。
未来 30 天内被利用的概率（EPSS）：0.86%，高于 58.4% 的漏洞。
暂无已修复版本：请关注参考资料中的厂商公告。

Package	Affected versions	Patched versions
org.jeecgframework.boot:jeecg-boot-common Maven	`≤ 3.5.3`	No fix yet
jeecg boot jeecg	`≤ 3.5.3`	No fix yet

Description

SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestSql component.

NVD description

SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestSql component.

References

nvd.nist.gov/vuln/detail/CVE-2023-41542 · ADVISORY
jeecgboot/jeecg-boot · PACKAGE
pho3n1x-web.github.io/2023/09/15/CVE-2023-41542%28JeecgBoot_sql%29 · WEB
pho3n1x-web.github.io/2023/09/15/CVE-2023-41542%28JeecgBoot_sql%29 · Exploit

org.jeecgframework.boot:jeecg-boot-common 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.jeecgframework.boot:jeecg-boot-common

Maven

≤ 3.5.3

No fix yet

jeecg boot

jeecg

≤ 3.5.3

No fix yet

Description

SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestSql component.

NVD description

SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestSql component.

org.jeecgframework.boot:jeecg-boot-common 的其他漏洞

查看全部 →