jeecgboot/jeecg-boot · Security
jeecg-boot vulnerable to SQL injection
- GHSA ID
- GHSA-23xf-5535-62v5
- CVE ID
- CVE-2023-1741
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
jeecg-boot 3.5.0 is vulnerable to SQL injection from functionality of the file SysDictMapper.java of the component Sleep Command Handler. The attack can be launched remotely and the exploit has been disclosed to the public and may be used.
CWEs
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')