CVE-2023-42268

Vulnerability

Overview CVE-2023-42268 is a SQL injection vulnerability found in JeecgBoot, an AI-driven low-code development platform. The vulnerability exists in versions up to and including v3.5.3, specifically within the /jeecg-boot/jmreport/show endpoint. The root cause is insufficient input sanitization, allowing an attacker to inject malicious SQL queries through crafted requests. The official description and issue tracker confirm the flaw is present in the org/jeecg/modules/jmreport/report/controller component, which fails to properly filter user-supplied parameters before passing them to database queries [2][3].

Exploitation

Details Exploitation does not require authentication, making it accessible to any remote attacker. The vulnerability is exploitable via boolean blind SQL injection techniques. The application employs a blacklist filter that blocks keywords such as exec, information_schema, insert, delete, update, and others. However, this blacklist can be bypassed using careful blind injection payloads that avoid those blocked terms. By observing the application's response differences (boolean-based inference), an attacker can extract sensitive data from the database without needing direct error messages [3]. The affected endpoint is exposed to both authenticated and unauthenticated users, widening the attack surface.

Impact

Successful exploitation allows an attacker to retrieve arbitrary data from the underlying database. Since the vulnerability is unauthenticated and can be exploited remotely, it poses a significant risk to confidentiality. An attacker could extract user credentials, session tokens, configuration secrets, or other sensitive information stored in the database. The blacklist bypass technique makes it possible to enumerate database content without triggering alarms or being blocked by simple keyword filters.

Mitigation

Status As of the latest analysis, JeecgBoot version 3.5.3 is the last affected release. The project's GitHub repository indicates that subsequent versions (e.g., 3.9.2) have been released, but the specific fix commit is not explicitly referenced in the issue. Administrators are strongly advised to upgrade to the latest available version to remediate this vulnerability. No official workaround has been documented; therefore, upgrading is the recommended course of action [1][3].