Threats tagged 'ghsa-vqwr-8q3r-m6hq'

JeecgBoot version 3.9.5 contains a SQL injection vulnerability in the JimuBI component, specifically in the /jeecg-boot/drag/onlDragDatasetHead/getAllChartData endpoint. This flaw allows remote attackers to manipulate the 'params' argument to execute SQL injection attacks. Public exploit code is available, and the vendor has not responded to disclosure attempts. The vulnerability has a high severity rating with a CVSS score of 7.3.