CVE-2024-48307
Published: 31 October 2024
Summary
CVE-2024-48307 is a critical-severity SQL Injection (CWE-89) vulnerability in Jeecg Jeecg Boot. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
JeecgBoot version 3.7.1 contains a SQL injection vulnerability in the /onlDragDatasetHead/getTotalData component, identified as CWE-89 and carrying a CVSS 3.1 score of 9.8 reflecting network attack vector, low complexity, and no authentication or user interaction requirements.
An unauthenticated remote attacker can supply crafted input to the affected endpoint to execute arbitrary SQL commands, enabling full read, write, or deletion of database contents and potentially leading to complete system compromise.
The referenced GitHub repository and issue 7237 document the flaw but contain no mitigation guidance. The EPSS score of 0.9221 indicates a high likelihood of exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-3080
Vulnerability details
JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.