CVE-2024-48307

Vulnerability

Overview CVE-2024-48307 is a SQL injection vulnerability in JeecgBoot v3.7.1, a low-code development platform. The issue resides in the /onlDragDatasetHead/getTotalData endpoint, which fails to properly sanitize user-supplied input in the fieldName parameter. This allows an attacker to inject arbitrary SQL commands into database queries [1].

Exploitation

An unauthenticated attacker can exploit this vulnerability by sending a crafted JSON payload to the endpoint. As demonstrated in a publicly disclosed proof-of-concept, the attacker can use concat(username,0x3a,password) in the fieldName to extract sensitive data from the sys_user table. No authentication is required, making this a critical risk [4].

Impact

Successful exploitation enables the attacker to execute arbitrary SQL queries, potentially leading to the extraction of all database contents, including user credentials and other sensitive information. This could result in full compromise of the application and underlying data.

Mitigation

The vulnerability was reported via a GitHub issue, and the latest version of JeecgBoot (3.9.2) likely contains a fix. Users are strongly advised to upgrade to the latest version or apply appropriate input validation and parameterized queries to the affected endpoint [1].