Back to KEVs

CVE-2023-1454

jeecg-boot qurestSql sql injection

Basic Information

CVE State
PUBLISHED
Reserved Date
March 17, 2023
Published Date
March 17, 2023
Last Updated
August 02, 2024
Vendor
jeecg
Product
jeecg-boot
Description
A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223299. Es wurde eine Schwachstelle in jeecg-boot 3.5.0 entdeckt. Sie wurde als kritisch eingestuft. Betroffen hiervon ist ein unbekannter Ablauf der Datei jmreport/qurestSql. Durch Beeinflussen des Arguments apiSelectId mit unbekannten Daten kann eine sql injection-Schwachstelle ausgenutzt werden. Umgesetzt werden kann der Angriff über das Netzwerk. Der Exploit steht zur öffentlichen Verfügung.
Tags
nuclei_scanner

CVSS Scores

CVSS v3.1

6.3 - MEDIUM

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVSS v3.0

6.3 - MEDIUM

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CVSS v2.0

6.5

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS Score

Score
92.70% (Percentile: 99.74%) as of 2025-06-14

Exploit Status

Exploited in the Wild
Yes (2025-05-25 00:00:00 UTC) Source

References

https://vuldb.com/?id.223299 https://vuldb.com/?ctiid.223299 https://github.com/J0hnWalker/jeecg-boot-sqli

Known Exploited Vulnerability Information

Source Added Date
The Shadowserver (via CIRCL) 2025-05-26 12:00:37 UTC

Scanner Integrations

Scanner URL Date Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-1454.yaml 2025-04-26 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

shad0w0sec/CVE-2023-1454-EXP

Type: github • Created: 2023-12-31 06:47:01 UTC • Stars: 3

JeecgBoot SQL（CVE-2023-1454）sqlmap 注入不出来的情况可以使用该脚本

Sweelg/CVE-2023-1454-Jeecg-Boot-qurestSql-SQLvuln

Type: github • Created: 2023-06-20 08:12:49 UTC • Stars: 21

jmreport/qurestSql 未授权SQL注入批量扫描poc Jeecg-Boot是一款基于Spring Boot和Jeecg-Boot-Plus的快速开发平台，最新的jeecg-boot 3.5.0 中被爆出多个SQL注入漏洞。

padbergpete47/CVE-2023-1454

Type: github • Created: 2023-04-21 09:27:45 UTC • Stars: 8

CVE-2023-1454,Jeecg-Boot 前台SQL注入,CVE-2023-1454批量检测

gobysec/CVE-2023-1454

Type: github • Created: 2023-03-24 03:02:33 UTC • Stars: 4

jeecg-boot unauthorized SQL Injection Vulnerability (CVE-2023-1454)

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Detected by Nuclei

  • Added to KEVIntel