CVE-2024-48307

The vulnerability results from a lack of proper validation and sanitization of input data passed to the /onlDragDatasetHead/getTotalData component. An attacker can inject malicious SQL code directly into the query executed by the application. Due to the network vector (AV:N) and lack of authentication requirements (PR:N) and user interaction (UI:N), the exploit can be executed remotely by anyone with access to the application.

An attacker can gain unauthorized access to sensitive data in the database, modify or delete its contents, and in certain database server configurations potentially take control of the system (RCE).

Apply patches available from the vendor according to the references. It is recommended to monitor the project repository at https://github.com/jeecgboot/JeecgBoot for the latest fix. As a temporary measure, consider restricting access to the vulnerable endpoint at the firewall or reverse proxy level.

JeecgBoot version 3.7.1