This vulnerability in jeecgboot JimuReport (up to version 2.3.0) involves improper handling of the dbUrl parameter in the DriverManager.getConnection function located in /drag/onlDragDataSource/testConnection of the Data Source Handler component. An attacker can remotely manipulate this argument to perform code injection. The vulnerability has been publicly disclosed, and the vendor has confirmed it, promising a fix in an upcoming release. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low complexity, and no user interaction required.

Successful exploitation allows remote attackers to inject and execute arbitrary code via the dbUrl parameter, potentially compromising the affected system. The impact is rated medium severity, reflecting limited scope or complexity in exploitation. No known active exploits have been reported so far.

Currently, no official patch or workaround is available. The vendor has confirmed the vulnerability and stated that a fix will be provided in an upcoming release. Users should monitor vendor communications for the release of the official patch and apply it promptly once available. Until then, consider restricting access to the affected component to trusted users or networks to reduce exposure.