From 067c93a8ef2d118f30b59eb80f8bd01443d47df6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=90=95=E6=B3=8A=E4=BC=B8?= Date: Tue, 25 Apr 2023 14:58:10 +0000 Subject: [PATCH 1/2] =?UTF-8?q?CVE-2023-1454=E6=8F=90=E4=BA=A4poc=20CVE-20?= =?UTF-8?q?23-1454=E6=8F=90=E4=BA=A4poc?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 吕泊伸 --- cve/jeecg/2023/CVE-2023-1454/README.md | 23 +++++++++++++++++++++++ cve/jeecg/2023/yaml/CVE-2023-1454.yaml | 20 ++++++++++++++++++++ 2 files changed, 43 insertions(+) create mode 100644 cve/jeecg/2023/CVE-2023-1454/README.md create mode 100644 cve/jeecg/2023/yaml/CVE-2023-1454.yaml diff --git a/cve/jeecg/2023/CVE-2023-1454/README.md b/cve/jeecg/2023/CVE-2023-1454/README.md new file mode 100644 index 00000000..7b0d7d77 --- /dev/null +++ b/cve/jeecg/2023/CVE-2023-1454/README.md @@ -0,0 +1,23 @@ +# CVE-2023-1454 + +## jeecg-boot unauthorized SQL Injection Vulnerability (CVE-2023-1454) + +| **Vulnerability** | **jeecg-boot unauthorized SQL Injection Vulnerability (CVE-2023-1454)** | +| :----: | :-----| +| **Chinese name** | jeecg-boot 未授权SQL注入漏洞（CVE-2023-1454 | +| **CVSS core** | 9.8 | +| **FOFA Query** (click to view the results directly)| [title=="JeecgBoot 企业级低代码平台"](https://fofa.info/result?qbase64=dGl0bGU9PSJKZWVjZ0Jvb3Qg5LyB5Lia57qn5L2O5Luj56CB5bmz5Y%2BwIg%3D%3Da) | +| **Number of assets affected** | 3957 | +| **Description** | JeecgBoot is a low -code development platform based on code generator. Java Low Code Platform for Enterprise web applications jeecg-boot(v3.5.0) latest unauthorized sql injection. | +| **Impact** | In addition to using SQL injection vulnerabilities to obtain information in the database (for example, the administrator's back-end password, the user's personal information of the site), an attacker can write a Trojan horse to the server even in a high-privileged situation to further obtain server system permissions. | + +![](https://s3.bmp.ovh/imgs/2023/03/24/3886eecddee5f04a.gif) + +**[Goby Official URL: https://gobies.org/](https://gobies.org/)** + +If you have a functional type of issue, you can raise an issue on GitHub or in the discussion group below: + +1. GitHub issue: https://github.com/gobysec/Goby/issues +2. Telegram Group: http://t.me/gobies (Group benefits: enjoy the version update 1 month in advance) +3. Telegram Channel: https://t.me/joinchat/ENkApMqOonRhZjFl (Channel benefits: enjoy the version update 1 month in advance) +4. WeChat Group: First add my personal WeChat: **gobyteam**, I will add everyone to the official WeChat group of Goby. (Group benefits: enjoy the version update 1 month in advance) diff --git a/cve/jeecg/2023/yaml/CVE-2023-1454.yaml b/cve/jeecg/2023/yaml/CVE-2023-1454.yaml new file mode 100644 index 00000000..0e96db3f --- /dev/null +++ b/cve/jeecg/2023/yaml/CVE-2023-1454.yaml @@ -0,0 +1,20 @@ +id: CVE-2023-1454 +source: https://github.com/PenTestical/CVE-2020-9484 +info: + name: jeecg SQL注入漏洞 + severity: high + description: + jeecg是一个应用软件。一款基于代码生成器的智能开发平台。jeecg-boot 3.5.0版本存在SQL注入漏洞，该漏洞源于文件 jmreport/qurestSql 存在安全问题， 通过参数 apiSelectId 导致SQL注入。 + scope-of-influence: + jeecg-boot 3.5.0版本 + reference: + - https://vuldb.com/?ctiid.223299 + - https://vuldb.com/?id.223299 + classification: + cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H + cvss-score: 7.5 + cve-id: CVE-2023-1454 + cwe-id: None + cnvd-id: CNNVD-202303-1399 + kve-id: None + tags: cve2023, jeecg \ No newline at end of file -- Gitee From e2703272fe158c109d44516241379af884153ee2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=90=95=E6=B3=8A=E4=BC=B8?= Date: Tue, 25 Apr 2023 14:59:15 +0000 Subject: [PATCH 2/2] update openkylin_list.yaml. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: 吕泊伸 --- openkylin_list.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openkylin_list.yaml b/openkylin_list.yaml index 9b6a0f88..069723ae 100644 --- a/openkylin_list.yaml +++ b/openkylin_list.yaml @@ -174,6 +174,8 @@ cve: Froxlor: - CVE-2021-42325 - CVE-2023-0315 + jeecg + - CVE-2023-1454 cnvd: apache-tomcat: - CNVD-2020-10487 -- Gitee