CVE-2024-48307

CVE-2024-48307 is a SQL injection vulnerability (CWE-89) in JeecgBoot v3.7.1, an open-source Java-based low-code platform, reachable through the /onlDragDatasetHead/getTotalData component. An attacker can send crafted input to parameters consumed by that endpoint over the network; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates exploitation requires no privileges, no user interaction, and low attack complexity. Successful injection can allow arbitrary SQL execution against the backend database, enabling theft or tampering of application data, with impact potentially limited by the database account's privileges. Any organization running JeecgBoot 3.7.1 is affected, particularly instances exposed to the internet or to untrusted users. There is no confirmed in-the-wild exploitation yet: a public PoC/reference exists (GitHub issue #7237), the flaw is not in CISA KEV, but its high EPSS score (44.3% probability of exploitation within 30 days, 99th percentile) signals an elevated near-term exploitation risk.

What to do: Upgrade JeecgBoot from 3.7.1 to the latest patched release per the vendor's GitHub advisories/releases (no fixed version is specified in the available data). Until patched, restrict or filter access to /onlDragDatasetHead/getTotalData at a reverse proxy or WAF, enforce authentication on that route if not already required, and monitor logs for SQL injection payloads targeting it. Internet-exposed JeecgBoot instances should be prioritized for patching given the elevated EPSS score.