CVE-2025-0391: Huayi-tec Jeewms SQL Injection Vulnerability

CVE-2025-0391 Overview

CVE-2025-0391 is a SQL injection vulnerability in Guangzhou Huayi Intelligent Technology Jeewms through version 20241229. The flaw resides in the saveOrUpdate function within org/jeecgframework/web/cgform/controller/build/CgFormBuildController.java. Attackers can manipulate input parameters to inject arbitrary SQL statements against the backend database. The vulnerability is exploitable remotely over the network and requires only low-privileged authentication. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse. The vendor addressed the issue in version 20250101, and administrators of affected deployments should upgrade without delay.

Critical Impact
Authenticated remote attackers can inject SQL through the saveOrUpdate handler in CgFormBuildController.java, enabling unauthorized data access, modification, or service disruption against Jeewms backends.

Affected Products

Guangzhou Huayi Intelligent Technology Jeewms versions up to and including 20241229
The CgFormBuildController component within the org.jeecgframework.web.cgform.controller.build package
Deployments exposing the Jeewms web interface to untrusted networks

Discovery Timeline

2025-01-11 - CVE-2025-0391 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-0391

Vulnerability Analysis

The vulnerability is a SQL injection issue classified under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component). Jeewms exposes the saveOrUpdate method in CgFormBuildController.java, which constructs SQL statements using user-controlled input without sufficient sanitization or parameterization. Attackers authenticated with low privileges can submit crafted HTTP requests that alter the structure of the resulting query.

Successful exploitation enables an attacker to read, modify, or delete data in the underlying database. Depending on database configuration, secondary impacts such as authentication bypass, privilege escalation within the application, or denial of service against database resources are possible. The EPSS model currently estimates the exploitation probability at 0.5%.

Root Cause

The root cause is the direct concatenation of attacker-controlled values into SQL queries within the dynamic form save and update workflow. The saveOrUpdate handler in CgFormBuildController.java accepts form metadata and field values that are passed into query construction without prepared statement bindings or strict allow-list validation. Any parameter consumed by this handler becomes a candidate for injection.

Attack Vector

The attack vector is network-based and requires low-privileged authentication to the Jeewms application. An attacker submits an HTTP request targeting the dynamic form endpoint backed by saveOrUpdate, embedding SQL metacharacters and clauses inside parameters that the controller forwards into the database. Because the exploit details are publicly disclosed through Gitee and VulDB, weaponization is straightforward for attackers with access to a valid low-tier account on the target instance.

No verified proof-of-concept code is published in the references beyond the issue tracker discussion. Refer to the Gitee Issue Report and VulDB entry 291125 for additional technical context.

Detection Methods for CVE-2025-0391

Indicators of Compromise

HTTP requests targeting Jeewms endpoints that invoke CgFormBuildController.saveOrUpdate containing SQL metacharacters such as single quotes, UNION, SELECT, --, or ;
Unexpected database errors in Jeewms application logs referencing the cgform module
Anomalous database queries originating from the Jeewms application service account, particularly queries touching tables outside the dynamic form schema
Outbound database connections or data egress patterns from the Jeewms host that do not match baseline behavior

Detection Strategies

Deploy web application firewall (WAF) signatures for SQL injection patterns targeting /cgform and related Jeewms request paths
Enable database query logging and alert on syntactically anomalous statements issued by the Jeewms service account
Correlate authentication events with subsequent saveOrUpdate calls to identify low-privileged accounts performing suspicious form operations

Monitoring Recommendations

Forward Jeewms application and web server logs to a centralized analytics platform for retention and correlation
Monitor database audit logs for INFORMATION_SCHEMA lookups or large result sets returned to the Jeewms application
Track failed login attempts and newly created low-privilege accounts that may be used as a launch point for exploitation

How to Mitigate CVE-2025-0391

Immediate Actions Required

Upgrade Jeewms to version 20250101 or later, which contains the vendor fix for the saveOrUpdate SQL injection
Audit existing Jeewms user accounts and disable or rotate credentials for unused or shared low-privilege accounts
Review database and application logs for prior exploitation attempts referencing the cgform endpoints

Patch Information

The vendor resolved the issue in Jeewms version 20250101. Administrators should apply this release through the standard Jeewms upgrade process and validate that the patched CgFormBuildController.java is loaded after deployment. Confirm the upgrade via the Gitee project.

Workarounds

Restrict network access to the Jeewms management interface using firewall rules or VPN-only access until the upgrade is complete
Apply WAF rules that block SQL metacharacters in parameters submitted to the cgform controller endpoints
Enforce least-privilege on the database account used by Jeewms so that injection cannot reach administrative tables or stored procedures
Increase logging verbosity on Jeewms and the backing database to capture exploitation attempts during the remediation window

bash

# Example: restrict Jeewms web access to a trusted management network
iptables -A INPUT -p tcp --dport 8080 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP