CVE-2023-40989: SQL Injection
SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.
Other sources
SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-40989?
CVE-2023-40989 is a SQL injection vulnerability in jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the `report/jeecgboot/jmreport/queryFieldBySql` component.
How severe is CVE-2023-40989?
CVE-2023-40989 has a severity rating of 9.8, which is classified as critical.
What software is affected by CVE-2023-40989?
jeecg-boot v 3.0 and 3.5.3 are affected by CVE-2023-40989.
How can a remote attacker exploit CVE-2023-40989?
A remote attacker can exploit CVE-2023-40989 by sending a crafted request to the `report/jeecgboot/jmreport/queryFieldBySql` component, which allows them to execute arbitrary code.
Are there any references for CVE-2023-40989?
Yes, you can find more information about CVE-2023-40989 on the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-40989), [GitHub](https://github.com/Zone1-Z/CVE-2023-40989/blob/main/CVE-2023-40989), [Advisories](https://github.com/advisories/GHSA-rwhx-6hx7-pqc8)