Cyber Resilience

CVE-2023-38992

CriticalPublic PoC

Published: 28 July 2023

Published
28 July 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.6411 98.5th percentile
Risk Priority 58 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-38992 is a critical-severity SQL Injection (CWE-89) vulnerability in Jeecg Jeecg Boot. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 1.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

jeecg-boot version 3.5.1 contains a SQL injection vulnerability via the title parameter at the /sys/dict/loadTreeData endpoint. The issue is tracked as CVE-2023-38992, carries a CVSS 3.1 score of 9.8, and is categorized under CWE-89.

An unauthenticated attacker can send crafted requests over the network to the affected endpoint and obtain full read, write, and disruption capabilities on the underlying database and application data.

The associated GitHub issues provide the initial disclosure but contain no explicit patch or mitigation guidance in the supplied references. The EPSS score reached a peak of 0.6695 and currently stands at 0.6411.

EU & UK References

Vulnerability details

jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

jeecg
jeecg boot
3.5.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References