CVE-2023-41543

The vulnerability (CWE-89) results from insufficient validation and sanitization of input data passed to SQL queries in the /sys/replicate/check endpoint. An attacker can inject malicious SQL code without needing to have any privileges or user interaction. The attack vector is network-based and the attack requires no special preconditions (AC:L, PR:N, UI:N), making it particularly easy to perform.

An attacker can gain access to sensitive information stored in the database and escalate their privileges in the application. The vulnerability is rated as critical with full impact on confidentiality, integrity and availability of the system (C:H/I:H/A:H).

Patches available from the vendor should be applied in accordance with the references. As an interim measure, consider restricting network access to the /sys/replicate/check endpoint and implementing WAF rules blocking SQL injection attempts.

Jeecg Boot version 3.5.3