JeecgBoot Injection Vulnerabilities

SQL injection in JeecgBoot 3.9.5's JimuBI component allows unauthenticated remote attackers to manipulate the 'params' argument of the /jeecg-boot/drag/onlDragDatasetHead/getAllChartData endpoint and influence backend database queries. The CVSS 4.0 base score is 6.9 with low confidentiality, integrity and availability impact, and the independent assessment rates this as a moderate priority rather than critical. The reporter states exploit code has been released publicly, but no CISA KEV entry is provided and confirmed active exploitation is not established.

Authenticated SQL injection in JeecgBoot 3.9.5 allows a low-privilege user who can reach the JimuReport Table Dictionary API endpoint /jeecg-boot/jmreport/form/getTableDictList to manipulate the searchSql argument and alter SQL queries, with low impact to confidentiality, integrity, and availability. The flaw is remote and requires no user interaction, but exploitation is gated by a valid low-privilege session; the disclosure states the exploit has been made available to the public. The supplied intelligence does not include a CISA KEV entry or confirmed active exploitation.