CVE-2023-38905

Summary

CVE-2023-38905 is a SQL injection vulnerability affecting Jeecg-boot version 3.5.0 and earlier. An attacker located on the same network can exploit this vulnerability by manipulating malicious SQL statements to cause a denial of service. Specifically, this vulnerability can be triggered through the use of functions such as Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE. This issue poses a serious risk to organizations using the affected version of Jeecg-boot and highlights the importance of promptly applying security patches.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.