JeecgBoot versions prior to 3.9.5 contain an SQL injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newline characters into SQL fragments. This bypass enables attackers to perform boolean or time-based blind SQL injection attacks via endpoints such as /sys/dict/getDictItems, potentially extracting sensitive database contents including administrator password hashes.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysCommentController exportXls handler. This flaw allows any authenticated user, including those with low privileges, to export all comments from the system. Attackers can access the /sys/comment/exportXls endpoint to download every sys_comment row, exposing comment text and user IDs for records they should not be able to access.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysDepartRoleController exportXls handler. This flaw allows any authenticated user, including those with minimal default roles, to export department role data. The exposed data includes role names, codes, descriptions, and the users who created them. The vulnerability has a CVSS score of 4.3, indicating medium severity.
JeecgBoot versions up to 3.9.5 have a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint. This flaw allows any authenticated user to modify low-code application dictionaries by supplying a dictionary's low_app_id via parameters or headers. The vulnerability enables renaming dictionaries and replacing their items without proper authorization.
JeecgBoot versions through 3.9.5 have an insecure direct object reference vulnerability in the AiragBaseApiController. This flaw allows authenticated users to read AI chat variables belonging to other users by manipulating the username parameter in a specific API endpoint. The vulnerability involves sending POST requests to /airag/api/getChatVariable with a target appId, username, and variable name to access stored chat memory values in Redis. The CVSS score is 4.3, indicating a medium severity issue.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the getTenantPackInfo handler. This flaw allows any authenticated user to read product pack membership information of other tenants. Low-privileged attackers can exploit this by supplying a tenantId and fixed packCode values to disclose administrator usernames, real names, phone numbers, and departments. The vulnerability has a medium severity rating with a CVSS score of 4.3.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the editThirdAppConfig handler. This flaw allows any authenticated user, including low-privileged attackers, to modify configurations of third-party integrations such as DingTalk, WeCom, or Feishu. Attackers can replace sensitive parameters like client id, client secret, agent id, and corp id, potentially redirecting directory synchronization and messaging to attacker-controlled applications or disrupting these services.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysMessageTemplateController delete handler. This flaw allows any authenticated user, including low-privileged attackers, to delete message templates by obtaining template IDs from an unprotected list endpoint. Deleting these templates can disrupt system notices and workflow reminders.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysMessageController delete handler. This flaw allows low-privileged authenticated users to delete message records by sending DELETE requests with arbitrary IDs. The vulnerability enables attackers to erase any sys_sms row without ownership verification, potentially disrupting notification records.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysUserController's queryChildrenByUsername handler. This flaw allows any authenticated user, including low-privileged attackers, to retrieve other users' account information such as names, emails, phone numbers, employee numbers, department assignments, and staff lists of departments those users manage.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysUserController addSysUserGroup handler. This flaw allows any authenticated user, including low-privileged attackers, to modify user group memberships by sending crafted POST requests. Specifically, attackers can add arbitrary users to administrator-maintained groups without proper permission checks. The vulnerability has a CVSS score of 4.3, indicating medium severity. No patch or remediation information is provided in the available data.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements. Exploitation involves calling the POST /sys/api/sendSysAnnouncement endpoint with arbitrary values for title, content, fromUser, and toUser, enabling forged announcements to be delivered via WebSocket, WeCom, DingTalk, and Feishu.
JeecgBoot versions up to 3.9.5 have a missing authorization vulnerability that allows low-privileged authenticated users to modify any department. By calling the PUT /sys/user/doUpdateDepartInfo endpoint, attackers can rename or re-parent departments and alter department heads without proper ownership or tenant checks. This vulnerability does not impact confidentiality or availability but allows unauthorized modification of department information.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the SysRoleController saveDatarule handler. This flaw allows low-privileged authenticated users to modify role data rules by sending crafted parameters, potentially altering or clearing row-level data filters. The vulnerability can lead to unauthorized widening of data access or modification of filtering rules for other roles.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the putCancelQuit handler of SysUserController. This flaw allows any authenticated user, including low-privileged attackers, to cancel user resignations by supplying user IDs and tenant identification parameters. The vulnerability enables restoration of ended, pending, or refused tenant memberships to normal status without proper authorization.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the batchEditUsers handler of SysUserController. This flaw allows any authenticated user with low privileges to modify user department assignments by sending crafted PUT requests. Attackers can move users, including administrators, between departments and overwrite their positions without proper authorization. The vulnerability has a medium severity score of 4.3 (CVSS 3.1). No patch or remediation information is currently provided.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by calling a specific API endpoint. This flaw enables low-privileged users to arbitrarily set user IDs, department IDs, and status values, potentially elevating users to department head roles or demoting existing ones. The vulnerability impacts the integrity of department-scoped views within the application.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the saveDatarule handler of the SysDepartRoleController. This flaw allows low-privileged authenticated users to modify department role data rules by sending crafted parameters. Exploitation can lead to unauthorized widening of row-level data access or alteration of filtering rules for other department roles.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. This flaw enables low-privileged users to supply an arbitrary userId parameter and retrieve another user's complete permission set, potentially identifying administrator accounts. The vulnerability has a medium severity with a CVSS score of 4.3.
JeecgBoot versions through 3.9.5 have a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController. This flaw allows any authenticated user, including low-privileged attackers, to send announcements without proper permissions. Attackers can craft POST requests to /sys/api/sendBusAnnouncement with forged sender, recipients, title, and content fields to deliver spoofed admin or system messages, potentially facilitating phishing attacks.