This vulnerability exists in jeecgboot JimuReport up to version 2.3.0 within the Data Source Handler component, specifically in the DriverManager.getConnection function accessed via /drag/onlDragDataSource/testConnection. An attacker able to manipulate the dbUrl parameter can perform code injection remotely. The CVSS 4.0 base score is 5.1 (medium), reflecting network attack vector, low complexity, no user interaction, but requiring high privileges and resulting in low impact on confidentiality, integrity, and availability. The vendor has acknowledged the issue and will provide a fix in a future release, but no official patch or mitigation guidance is currently available.

Successful exploitation allows remote code injection via the dbUrl argument, potentially enabling an attacker with high privileges to execute arbitrary code within the affected component. The impact on confidentiality, integrity, and availability is rated low, but the presence of public exploit information increases the risk of attack. No known exploits in the wild have been reported yet.

No official patch or remediation is currently available. The vendor has confirmed the vulnerability and plans to release a fix in an upcoming version. Until a patch is released, users should restrict access to the affected endpoint and limit privileges to trusted users only. Monitor vendor advisories for the official fix and apply it promptly once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.