CVE-2026-108684: erzhongxmu Jeewms Autocomplete Data JeecgFormDemoController.java getTreeData sql injection
A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler. Performing a manipulation of the argument searchVal results in sql injection. The attack can be initiated remotely. The patch is named 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0. It is recommended to apply a patch to fix this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
erzhongxmu Jeewmsto a version that resolves this vulnerability.Patch 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0
Event History
Frequently Asked Questions
Who needs to authenticate before attempting exploitation?
The vulnerability has a privileges-required rating of low (PR:L), so an attacker needs an account or other access with low-level privileges. The attack can then be initiated remotely without user interaction.
Which deployments should be prioritized for remediation?
Jeewms deployments up to version 3.7 should be prioritized, particularly where the Autocomplete Data Handler is reachable by low-privileged users. The affected code is the getTreeData function in JeecgFormDemoController.java.
What fix is identified for this issue?
The identified patch is commit 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0. Applying that patch is the recommended remediation.