External risk intelligence

Jeecg-boot SQL Injection Vulnerability in Duplicate Check Component.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-45206

Jeecg-boot is a low-code development platform commonly deployed as a web application. The vulnerable component is part of the application's core functionality, which is typically accessible to users over the web in standard deployments, making it a likely target for internet-based interaction.

SQL Injection

Jeecg Boot

3.4.3

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical SQL injection vulnerability has been identified in the Jeecg-boot platform, affecting version 3.4.3. This vulnerability allows unauthenticated attackers to access or modify data without authorization due to flaws in how the system handles database queries.

A platform flaw allows unauthorized data access.
It impacts systems using this development tool.
Confirm if this platform is in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted request to the application's `/sys/duplicate/check` endpoint. This component is part of the core functionality of the Jeecg-boot platform, which is often exposed to the internet as a web application. If successful, the attacker could gain unauthorized access to and modify sensitive data.

No authentication required.
Triggered by specific API calls.
Risk of data compromise and modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary SQL commands. When supported by the advisory, this could lead to the disclosure, modification, or deletion of system data, or unauthorized changes to service behavior.

System data could be exposed or modified.
Unauthenticated network access can trigger it.
Unauthorized data access or alteration.

Operational Fix

Recommended remediation, mitigation, and detection steps

Identifying and remediating this SQL injection vulnerability requires coordination between the application owners responsible for Jeecg-boot deployments and potentially the infrastructure or platform teams managing the underlying environment. The first critical step is to locate all instances of the affected software, determine their business criticality and external reachability, and confirm the accountable owner for each deployment. Subsequent actions should be prioritized based on this risk assessment, involving vendor coordination if necessary.

Application owners must lead remediation efforts.
Verify external reachability and criticality first.
Plan phased remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Jeecg-boot?

Jeecg-boot is a low-code development platform used to build enterprise-grade web applications quickly. It provides a foundational framework that simplifies back-end and front-end integration, allowing developers to generate code and manage data components efficiently. It is widely used to host business logic and service internal or external application traffic.

What does CVE-2022-45206 mean for data security?

This vulnerability is classified as a SQL injection (CWE-89). It means the application fails to properly sanitize user input before passing it to the database. An attacker can take advantage of this by injecting their own database commands, potentially allowing them to view, change, or delete sensitive information stored within the system.

How is this SQL injection triggered?

The vulnerability is triggered when an attacker sends a specially crafted network request to the /sys/duplicate/check endpoint. Because the endpoint does not require the user to be logged in, no prior authentication is needed to attempt the attack. It is important to note that simply visiting the application or browsing standard pages without hitting this specific function does not trigger the flaw.

Is my instance of Jeecg-boot at risk?

Halo Surface Signal indicates that because Jeecg-boot is a web application and this component is part of its core functionality, it is a likely target if reachable via the internet. If your deployment is exposed to the public web rather than restricted to an internal network, the risk of unauthorized interaction with this endpoint increases significantly.

What steps should I take if I use Jeecg-boot?

Begin by auditing your environment to locate all instances of Jeecg-boot version 3.4.3. Once identified, evaluate which instances are business-critical and which are reachable from the public internet. Coordinate with your team to determine the owner of each deployment and prioritize those with higher exposure for remediation, while checking with the vendor for the official fix.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.