Jeecg Boot

Server-side request forgery in JeecgBoot 3.9.0's /sys/common/uploadImgByHttp endpoint allows authenticated attackers to manipulate the fileUrl parameter and make arbitrary HTTP requests from the vulnerable server. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor despite early disclosure notification.

SQL injection in JeecgBoot versions up to 3.9.1 allows authenticated remote attackers to manipulate the keyword parameter in the dictionary loading endpoint, potentially enabling unauthorized data access or modification. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires valid credentials but can be executed over the network with low complexity.

JeecgBoot 3.9.1's RAG knowledge controller fails to properly validate ZIP file imports, allowing authenticated remote attackers to trigger unsafe deserialization with public exploit code available. The vulnerability requires authentication and complex attack execution but could enable information disclosure or integrity compromise. No patch is currently available from the vendor.

Path traversal in JeecgBoot's Retrieval-Augmented Generation Module (versions up to 3.9.0) allows authenticated remote attackers to access arbitrary files through manipulation of the filePath parameter in the /airag/knowledge/doc/edit endpoint. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor despite early notification.

SQL injection in JeecgBoot 3.9.0's Online Report API endpoint allows authenticated remote attackers to manipulate the keyword parameter and execute arbitrary database queries. Public exploit code exists for this vulnerability, and the vendor has not provided a patch despite early notification. An attacker with valid credentials can leverage this flaw to read, modify, or delete sensitive database information.

We need to generate a JSON object based on the provided CVE data. We must follow all instructions precisely. Let's extract data: - CVE ID: CVE-2025-15126 - Description: "A weakness has been identified in JeecgBoot up to 3.9.0. Affected by this vulnerability is the function getPositionUserList of the file /sys/position/getPositionUserList. This manipulation of the argument positionId causes improper authorization. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way." - CVSS Score: 1.3 (CVSS 4.0 base score? Actually it says CVSS Score: 1.3, CVSS Vector: CVSS:4.0/... so it's a 4.0 score). The vector: AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/... That means: Attack Vector: Network, Attack Complexity: High, Attack Requirements: None, Privileges Required: Low, User Interaction: None, Confidentiality: Low, Integrity: None, Availability: None, no scope change, Exploit maturity: Proof-of-Concept. - CWE: CWE-266 (Incorrect Privilege Assignment) - EPSS Score: 0.04% (percentile 11%) - POC/Exploit: Publicly available - Reported by: cna@vuldb.com - CPE: cpe:2.3:a:jeecg:jeecg_boot:*:*:*:*:*:*:*:* - Tags: Information Disclosure, Jeecg Boot - References: - github.com/Hwwg/cve/issues/39 (exploit) - vuldb.com/?ctiid.338504 - vuldb.com/?id.338504 - vuldb.com/?submit.711782 (exploit) Now, we need to synthesize all this into a thorough analysis. The description says "manipulation of the argument positionId causes improper authorization" - CWE-266. So it's like an IDOR or authorization bypass allowing maybe unauthorized access to user list? The function name getPositionUserList suggests retrieving user list for a position, and improper authorization on positionId could allow a low-privileged user to see others' data. CVSS: Confidentiality Low, no other impact. The CVSS vector is 4.0, so we need to assess ourselves using 3.1 and 4.0 vectors consistent with our own assessment. The provided vector is CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P. So we need to map that to 3.1 metrics: AV:N, AC:H, PR:L, UI:N, S:U, C:L, I:N, A:N. That would be CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. But the instructions say: "assessed_cvss_vector: Your OWN independent CVSS 3.1 base-metric vector for THIS vulnerability, grounded in the description and exploitation conditions — NOT a copy of any score in the input." So we should confirm that this matches our assessment. Description: "remote attack ... complexity high ... exploitation difficult ... improper authorization ... manipulate argument positionId ..." So indeed, remote, needs authentication? The CVSS says PR:L, so low privileges. No user interaction. Impact: only confidential info (low). So we can generate that vector. For 4.0, we'll also produce a vector consistent with that, but note that the provided one already has AT:N (Attack Requirements None), so we can just reuse that. However, we should add exploit maturity? The instruction says "base vector" only, not including temporal/environmental. So we'll just output the base vector without E/X/etc. So for 4.0: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. That matches the provided one stripped of temporal. For 3.1: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N. Now, for fields: product_name: "JeecgBoot" (it's 1-3 words, the product name is JeecgBoot, Jeecg Boot). So "JeecgBoot" or "Jeecg Boot"? In description "JeecgBoot" so I'll use "JeecgBoot". summary: Must be original synthesis, not copy description. Start with impact verb. So: "Improper authorization in JeecgBoot up to 3.9.0 allows authenticated low-privileged attackers to access position-based user lists by manipulating the positionId parameter. The vulnerability in the getPositionUserList endpoint exposes potentially sensitive user data. Exploit code is publicly available, though attack complexity is high." Make sure not to start with "A vulnerability". That's fine. Mention that exploit is public, POC exists. EPSS low (0.04%) but not notable. No KEV mention. So summary: "Improper authorization in JeecgBoot versions up to 3.9.0 allows low-privileged remote attackers to enumerate position-associated user data via crafted positionId parameter manipulation on the /sys/position/getPositionUserList endpoint. The issue exposes limited confidential information, and publicly available exploit code exists, although exploitation requires high attack complexity." That's good. technical_context: Explain underlying technology: JeecgBoot is a Java-based low-code development platform. The CWE-266 Incorrect Privilege Assignment means the authorization check for the positionId parameter is flawed. The /sys/position/getPositionUserList endpoint likely returns list of users belonging to a specific position, and without proper verification, a user could query positions they shouldn't have access to. CPE indicates product: jeecg:jeecg_boot. So I'll write something educational: "JeecgBoot is an open-source low-code Java development platform. The flawed endpoint /sys/position/getPositionUserList is designed to return user lists for a given position. Under CWE-266, incorrect privilege assignment stems from missing or insufficient authorization checks on the positionId parameter, enabling an authenticated user with minimal privileges to access user data associated with arbitrary positions. This is a classic IDOR (Insecure Direct Object Reference) variant where the parameter lacks proper ownership validation." risk_assessment: Need to combine signals: CVSS 4.0 score 1.3 (very low), but that's due to high attack complexity and only low confidentiality impact. EPSS 0.04% (low exploitation likelihood). KEV: no, not in KEV. POC: publicly available. SSVC: Exploitation: public PoC (but no active exploitation). Automatable: high complexity makes automation unlikely. Technical Impact: low (confidentiality, no integrity/availability). So real-world priority is low despite public exploit. Contrast: "CVSS indicates network attack vector but high complexity, requiring attacker to already have low-privileged account. EPSS score is low (0.04%), suggesting limited exploitation probability. No active exploitation reported. Public exploit code exists but is not easily weaponized due to difficulty." That covers. Also note missing vendor response. affected_products: Write paragraph: "JeecgBoot versions up to 3.9.0 are affected, as per CPE cpe:2.3:a:jeecg:jeecg_boot:*:*:*:*:*:*:*:*. The vendor has not responded to disclosure, and no official advisory or patch version is available. Reference: (provide links from references) https://vuldb.com/?id.338504 and the GitHub issue link https://github.com/Hwwg/cve/issues/39." Actually the description says "up to 3.9.0", so version range all versions through 3.9.0. remediation: Primary fix? No patch available, vendor hasn't responded. So suggest compensating controls: "No vendor-released patch is available; the vendor has not responded to disclosure. As a mitigation, restrict access to the /sys/position/getPositionUserList endpoint to authorized users only via web application firewall rules or reverse proxy, or disable the feature if not needed. Implement strict authorization checks on positionId to ensure users can only query their own positions. Contact JeecgBoot developers for an official fix." Since patch is not available, say "No vendor-released patch identified at time of analysis". Then suggest workarounds. exploit_scenario: Realistic attack scenario: "An authenticated attacker with standard user privileges sends crafted requests to /sys/position/getPositionUserList with arbitrary positionId values, potentially enumerating user lists across different organizational positions. This could leak sensitive organizational structure information and user associations, although exploitation is difficult due to required knowledge of valid position IDs." exploitation_conditions: Must be specific prerequisites. The description says: function getPositionUserList of /sys/position/getPositionUserList, argument positionId. So conditions: "The attacker must be authenticated with at least low-level user privileges (PR:L). The target must have the /sys/position/getPositionUserList endpoint accessible. The attacker must be able to manipulate the positionId parameter. No default configuration changes are required; the vulnerability is inherent in the function's authorization logic. High attack complexity arises from the need to guess or know valid position IDs to enumerate users, but these may be predictable or brute-forceable." Note that the CVSS says AC:H, so we can mention that it's not trivial. No user interaction required. attack_chain: Steps: "Access authenticated session as low-privileged user → Enumerate or guess valid position IDs → Send crafted request to /sys/position/getPositionUserList with target positionId → Exfiltrate user list data associated with that position." That's 3-4 steps. I'll use 4-step: Access → Delivery → Exploit → Impact? More like: "Authenticate as low-privileged user → Identify valid positionId values → Send manipulated request to getPositionUserList → Retrieve confined user data." So: "Authenticate with low privileges → Discover or brute-force valid positionId values → Send crafted HTTP request to /sys/position/getPositionUserList → Receive user list data associated with targeted position." That's 4 steps. Good. confidence_notes: "Public exploit code available (GitHub issue). Vendor unresponsive; no official fix confirmed. CVSS and CWE assigned by VulDB. EPSS data sourced from FIRST. Affected version range inferred from description and CPE. No active exploitation confirmed." That's specific. Forbidden generic phrases: Avoid "analysis based on available data" – I'll state exactly what is confirmed and missing. prevalence: JeecgBoot is an open-source low-code platform, likely used but not as widespread as major frameworks. I'd say "medium" – it's a commonly used Java low-code tool, but not ubiquitous like Spring. Anchors: medium "common but not everywhere". Prevalence basis: "open-source Java low-code platform with moderate enterprise adoption". So "medium". prevalence_basis: "open-source Java low-code platform with moderate enterprise adoption" within 12 words. assessed_cvss_vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N assessed_cvss_rationale: "Requires low-privileged account and high attack complexity to guess position IDs; only low confidentiality impact." (within 25 words). That justifies AC:H, C:L. assessed_cvss40_vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N (no temporal). Now construct JSON. All fields must be plain text strings. No markdown. Ensure I don't use prohibited phrases. Product_name: "JeecgBoot". Summary not starting with A vulnerability etc. Technical_context: explain CWE-266, etc. Risk_assessment: mention all signals. Affected_products: paragraph with links. Remediation: no patch, suggest mitigations. Exploit_scenario: realistic. Exploitation_conditions: specific. Attack_chain: steps separated by ' → '. Confidence_notes: specific. Prevalence and basis: "medium" and justification. Check exploitation conditions: "FORBIDDEN generic phrases: 'Network access required.' / 'Specific configuration needed.' / 'Depends on deployment.'" So I need to avoid those. I will list the exact prerequisites: authenticated as low-privileged user, accessible endpoint, ability to manipulate positionId. I'll note that no special configuration is required beyond the existence of the feature. That is specific. I'll

Improper authorization in JeecgBoot up to 3.9.0 allows low-privileged authenticated attackers to enumerate department permission information via a crafted request to /sys/permission/queryDepartPermission, leading to limited information disclosure. The vulnerability requires high attack complexity, and while a public exploit is available, no active

Improper authorization in Jeecg Boot up to 3.9.0 allows authenticated remote attackers to bypass permission checks and access sensitive information by manipulating the 'departId' parameter in the /sys/sysDepartPermission/list API endpoint. Exploitation requires low privileges and high attack complexity, and a proof-of-concept exploit is publicly available. EPSS indicates a 0.03% probability of exploitation.

Improper authorization in JeecgBoot up to 3.9.0 allows remote attackers with low privileges to access restricted data rule configuration information. The vulnerability resides in the /sys/sysDepartPermission/datarule/ endpoint and requires high attack complexity. A public exploit is available, but no active exploitation has been confirmed; EPSS indicates very low exploitation probability.

Improper authorization in JeecgBoot up to version 3.9.0 allows authenticated remote attackers to manipulate departId and roleId parameters in the /sys/sysDepartRole/datarule/ endpoint to disclose sensitive information. The vulnerability requires legitimate user access and high exploitation complexity, but publicly available exploit code exists and the vendor did not respond to early disclosure attempts.

Improper authorization in JeecgBoot up to version 3.9.0 allows authenticated remote attackers to access unauthorized department role data via manipulation of the departId parameter in the getDeptRoleList endpoint, resulting in information disclosure of sensitive role assignments. The vulnerability requires login credentials and high attack complexity but has publicly available exploit code; however, real-world exploitation risk remains minimal given the 0.03% EPSS score and authentication prerequisite.

Information disclosure in Jeecg Boot up to version 3.9.0 allows authenticated low-privilege users to access department role data by manipulating the deptId parameter in the /sys/sysDepartRole/list endpoint. The vulnerability has high attack complexity and publicly available exploit code exists, though no active exploitation has been confirmed by CISA KEV. Impact is limited to low confidentiality loss with no integrity or availability impact.

JeecgBoot versions up to 3.9.0 allow authenticated remote attackers to manipulate user session management through the SysUserOnlineController, resulting in unauthorized session access with low availability impact. Public exploit code is available, though the CVSS score of 2.1 reflects limited real-world risk due to the requirement for authenticated access and minimal impact scope. Active exploitation has not been confirmed in CISA KEV, and the EPSS score of 0.13% indicates low probability of widespread exploitation despite public POC availability.

Authentication bypass in JeecgBoot up to version 3.9.0 allows authenticated remote attackers to manipulate tenant ID arguments in the SysTenantController, resulting in improper authentication checks that grant unauthorized access to other tenants' data. The vulnerability has a low CVSS score of 2.1 but publicly available exploit code exists, suggesting active researcher interest despite minimal real-world impact signals (EPSS 0.32%, low severity scope). Exploitation requires prior authentication and produces only limited information disclosure within the multi-tenant architecture.

Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. The endpoint is /sys/comment/addFile. This vulnerability allows attackers to upload files with system-whitelisted extensions to the system directory /opt, instead of the /opt/upFiles directory specified by the web server.

Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. This vulnerability allows attackers to upload files with system-whitelisted extensions to the system directory /opt, instead of the /opt/upFiles directory specified by the web server.

A vulnerability classified as problematic was found in JeecgBoot up to 3.8.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableData component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replicate/check. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestSql component. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Directory Traversal vulnerability in jeecg-boot v.3.6.0 allows a remote privileged attacker to obtain sensitive information via the file directory structure. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Jeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the component /jeecg-boot/jmreport/show. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Jeecg boot up to v3.5.3 was discovered to contain an arbitrary file read vulnerability via the interface /testConnection. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

jjeecg-boot V3.5.0 has an unauthorized arbitrary file upload in /jeecg-boot/jmreport/upload interface. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A vulnerability was found in jeecg-boot 3.5.0 and classified as critical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A vulnerability was found in jeecg-boot 3.5.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A vulnerability classified as critical has been found in jeecg-boot 3.5.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/deleteRecycleBin. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/putRecycleBin. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/duplicate/check. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A vulnerability was found in jeecg-boot. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.