Jeecg-Boot getTotalData 存在SQL注入漏洞（CVE-2024-48307）

2025-02-19 Jeecg PoC No

Description

JeecgBoot是一款基于代码生成器的低代码开发平台，它专为简化Java项目开发流程、提高开发效率而设计。JeecgBootv3.7.1中的/onlDragDatasetHead/getTotalData组件发现存在SQL注入漏洞。攻击者可以无需权限利用jimureport-dashboard-spring-boot-starter-1.8.1-beta.jar查询数据库，导致数据库信息泄露。

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

https://nvd.nist.gov/vuln/detail/CVE-2024-48307
https://github.com/jeecgboot/JeecgBoot/issues/7237
https://github.com/eeeeeeeeee-code/POC/blob/main/wpoc/JeecgBoot/JeecgBoot%E6%8E%A5%E5%8F%A3getTotalData%E5%AD%98%E5%9C%A8%E6%9C%AA%E6%8E%88%E6%9D%83SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E(CVE-2024-48307).md
https://cloud.tencent.com/developer/article/2549725
https://avd.aliyun.com/detail?id=AVD-2024-48307
https://blog.csdn.net/nnn2188185/article/details/144216929
https://cloud.tencent.com/developer/article/2472068
https://vuldb.com/zh/?id.282585
https://github.com/projectdiscovery/nuclei-templates/issues/11297
https://www.sentinelone.com/vulnerability-database/cve-2024-48307/

Description

PoC

References

Related Vulnerabilities