CVE-2023-1454: Jeecg Boot SQL Injection Vulnerability

CVE-2023-1454 Overview

CVE-2023-1454 is a SQL injection vulnerability in jeecg-boot 3.5.0, an open-source low-code development platform. The flaw resides in the jmreport/qurestSql endpoint, where the apiSelectId parameter is passed to a SQL query without proper sanitization. Attackers can manipulate this parameter remotely and without authentication to inject arbitrary SQL statements. The vulnerability is tracked as VulDB identifier VDB-223299 and the exploit has been publicly disclosed. The weakness is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL queries against the backend database, leading to data theft, data manipulation, and potential full database compromise.

Affected Products

jeecg jeecg-boot 3.5.0
Component: jmreport/qurestSql endpoint
Vulnerable parameter: apiSelectId

Discovery Timeline

2023-03-17 - CVE-2023-1454 published to NVD
2026-01-02 - Last updated in NVD database

Technical Details for CVE-2023-1454

Vulnerability Analysis

The vulnerability exists in the JimuReport module bundled with jeecg-boot 3.5.0. The jmreport/qurestSql HTTP endpoint accepts the apiSelectId parameter and concatenates its value directly into a backend SQL query. Because the input is neither parameterized nor sanitized, attacker-controlled SQL syntax reaches the database engine for execution.

The endpoint requires no authentication, which lowers the barrier to exploitation. JimuReport is a reporting component that executes user-supplied SQL templates by design, expanding the attack surface when access controls are missing. Successful exploitation gives an attacker the same database privileges held by the application service account.

With full database read and write access, an attacker can exfiltrate credentials, application secrets, and business data. Write access supports tampering with records and inserting backdoor accounts. In many deployments, database functions can also be abused to read files or execute operating system commands, extending impact beyond the database layer.

The high EPSS percentile assigned to this CVE reflects observed scanning and exploitation activity targeting jeecg-boot instances exposed to the internet.

Root Cause

The root cause is the construction of SQL queries through string concatenation with untrusted input. The apiSelectId parameter is treated as a trusted SQL fragment rather than a data value. The application does not use prepared statements, parameter binding, or allow-list validation before passing the value to the SQL engine.

Attack Vector

Exploitation occurs over the network against the HTTP interface of jeecg-boot. An attacker sends a crafted request to jmreport/qurestSql with a malicious payload in apiSelectId. Typical payloads use UNION SELECT constructs to read arbitrary tables or stacked queries to modify data. A public proof of concept is available in the GitHub PoC Repository.

The vulnerability is exploitable without credentials or user interaction. Refer to the VulDB advisory for additional technical context on the injection point and payload structure.

Detection Methods for CVE-2023-1454

Indicators of Compromise

HTTP requests to /jmreport/qurestSql containing SQL keywords such as UNION, SELECT, SLEEP, BENCHMARK, or comment sequences (--, #, /*) in the apiSelectId parameter.
Unusually long or URL-encoded values in the apiSelectId parameter from external IP addresses.
Database error messages or anomalous query latency originating from the JimuReport module.
Outbound DNS or HTTP callbacks from the database host that correlate with inbound requests to jmreport/qurestSql.

Detection Strategies

Deploy web application firewall rules that inspect requests to /jmreport/* endpoints for SQL injection patterns.
Enable database query logging and alert on queries originating from the JimuReport service that contain stacked statements or schema enumeration.
Review application access logs for the jmreport/qurestSql path and baseline expected request volume and source addresses.

Monitoring Recommendations

Monitor authentication tables, user tables, and configuration tables for unexpected INSERT, UPDATE, or DELETE operations.
Track egress traffic from application and database servers for callbacks to unknown hosts that may indicate out-of-band SQL injection.
Aggregate jeecg-boot logs into a centralized SIEM and create correlation rules linking HTTP injection patterns to subsequent database anomalies.

How to Mitigate CVE-2023-1454

Immediate Actions Required

Restrict network access to the jeecg-boot management interface, blocking jmreport/qurestSql from untrusted networks until an upgrade is applied.
Upgrade jeecg-boot to a version later than 3.5.0 that addresses the JimuReport SQL injection.
Rotate database credentials, API keys, and any secrets stored in the affected database, assuming compromise on internet-exposed instances.
Review database logs and audit tables for evidence of prior exploitation against the jmreport/qurestSql endpoint.

Patch Information

The jeecg-boot maintainers address the JimuReport injection in releases after 3.5.0. Consult the project repository and the VulDB advisory for current fixed-version guidance, and validate that the embedded JimuReport library is also updated.

Workarounds

Place jeecg-boot behind a reverse proxy or WAF that filters SQL metacharacters in the apiSelectId parameter.
Disable or remove the JimuReport qurestSql endpoint where the reporting functionality is not required.
Enforce authentication on all /jmreport/* routes through a gateway, and restrict access to a small set of administrative source addresses.
Run the jeecg-boot database account with least privilege, removing FILE, SUPER, and other dangerous privileges to limit injection impact.

bash

# Example nginx rule to block requests to the vulnerable endpoint
location ~* /jmreport/qurestSql {
    deny all;
    return 403;
}