CVE-2026-124554: JeecgBoot JimuBI getAllChartData sql injection
A security flaw has been discovered in JeecgBoot 3.9.5. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argument params results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue is remotely exploitable over the network and requires no privileges or user interaction. An attacker manipulates the params argument handled by the JimuBI getAllChartData endpoint.
Is exploit code available?
Yes. The exploit has been publicly released and may be used in attacks.
Which deployments should be prioritized for investigation?
Deployments running JeecgBoot 3.9.5 with the JimuBI component and the affected getAllChartData endpoint exposed to remote access should be prioritized. The available information does not state whether the vulnerable behavior is enabled by default.
Is a vendor fix or mitigation available?
No vendor response, fix, or workaround is identified in the available information. If patching is not immediately possible, the provided data does not document a validated mitigation.