CVE-2023-38905

MediumCVSS 5.5

Published: 17/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

19th percentile - higher than 19% of all known CVEs

Summary

Version 3.5.0 and earlier of Jeecg-boot contains an SQL injection vulnerability that allows a local attacker to cause a denial of service using functions such as Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE.

Risk Assessment

This vulnerability could lead to significant disruptions in system operation, potentially affecting the availability of services within the organization.

Recommendation

It is recommended to upgrade to the latest version of Jeecg-boot to mitigate this vulnerability and to monitor the system for unauthorized activities.

Original NVD description (English source)

SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE functions.