{"id":"CVE-2026-124554","kind":"vulnerability","aliases":["CVE-2026-124554"],"related":[],"title":"JeecgBoot: JimuBI chart endpoint lets remote users run SQL injection","description":"A security flaw has been discovered in JeecgBoot 3.9.5. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argument params results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"A flaw in the JimuBI component of JeecgBoot 3.9.5 lets a remote attacker inject SQL through the params argument of the getAllChartData endpoint. A public exploit exists, so an attacker could read or change database contents.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"JeecgBoot","fixed":[],"affected":"3.9.5","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["java","jeecgboot","package","self-hosted"],"not_affected_if":["other-versions"],"how_to_check":"- Confirm the installed JeecgBoot version is 3.9.5 (the only version named in the record)\n- Check whether /jeecg-boot/drag/onlDragDatasetHead/getAllChartData is reachable from outside your network\n- Also check if you run a newer build: v3.9.6 upgrades Jimu BI to 2.5.6.1 but its notes do not say this issue is fixed","fix":null,"status":"open","published_at":"2026-11-09T02:16:59+00:00","first_seen_at":"2026-11-09T02:24:16+00:00","triaged_at":"2026-11-09T02:26:24+00:00","updated_at":"2026-11-09T02:26:57+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-09T02:26:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"JeecgBoot: JimuBI chart endpoint lets remote users run SQL injection","impact":"high","summary":"A flaw in the JimuBI component of JeecgBoot 3.9.5 lets a remote attacker inject SQL through the params argument of the getAllChartData endpoint. A public exploit exists, so an attacker could read or change database contents.","audience":"businesses","category":"package","nicknames":[],"who_cares":["jeecgboot","java","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reads or alters database contents through injected SQL","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-124554 for the authentication requirement and any fixed version; the vendor did not respond to disclosure.","how_to_check":"- Confirm the installed version of JeecgBoot is `3.9.5`\n- Check whether the JimuBI drag dataset endpoint `/jeecg-boot/drag/onlDragDatasetHead/getAllChartData` is reachable from outside your network\n- unknown for any other check, as the sources do not say","plain_action":"","product_name":"JeecgBoot","needs_analyst":true,"not_affected_if":["other-versions"],"who_is_affected":"JeecgBoot 3.9.5 installations that expose the JimuBI chart endpoint are affected, and the sources say remote exploitation is possible. The sources do not say whether authentication or a non-default setting is required. Teams running other versions or without JimuBI can likely skip it, but the sources do not confirm this.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000776,"input_tokens":4591,"output_tokens":633,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-124554 for the authentication requirement and any fixed version; the vendor did not respond to disclosure.","search":"'-124554':13A,16A '-2026':12A,15A '/jeecg-boot/drag/onldragdatasethead/getallchartdata':77C '3.9.5':32B,68C 'affect':70C 'argument':42B,87C 'attack':36B,53B,97C,113C 'chang':57B 'chart':3A 'compon':29B,80C 'contact':117C 'content':59B 'could':54B 'cve':11A,14A 'databas':58B 'disclosur':121C 'discov':65C 'earli':118C 'endpoint':4A,46B 'exist':50B 'exploit':49B,94C,101C 'file':76C 'flaw':25B,62C 'getallchartdata':45B 'host':23B 'inject':10A,37B,92C 'java':18B 'jeecgboot':1A,17A,19B,31B,67C 'jimubi':2A,28B,81C 'let':5A,33B 'manipul':84C 'may':109C 'packag':20B 'param':41B,88C 'part':73C 'perform':82C 'possibl':99C 'public':48B,107C 'read':55B 'releas':104C 'remot':6A,35B,93C 'respond':125C 'result':89C 'run':8A 'secur':61C 'self':22B 'self-host':21B 'sql':9A,38B,91C 'unknown':72C 'use':111C 'user':7A 'vendor':115C 'way':128C","nicknames":[],"mitigations":[],"who_affected":"JeecgBoot 3.9.5 installations that expose the JimuBI chart endpoint are affected, and the sources say remote exploitation is possible. The sources do not say whether authentication or a non-default setting is required. Teams running other versions or without JimuBI can likely skip it, but the sources do not confirm this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["jeecgboot"],"ptokens":["jeecgboot"],"labels":["high","java","jeecgboot","package","selfhosted","vendor"],"campaign_type":null,"search_a":"'-124554':13A,16A '-2026':12A,15A 'chart':3A 'cve':11A,14A 'endpoint':4A 'inject':10A 'jeecgboot':1A,17A 'jimubi':2A 'let':5A 'remot':6A 'run':8A 'sql':9A 'user':7A","search_b":"'3.9.5':32B 'argument':42B 'attack':36B,53B 'chang':57B 'compon':29B 'content':59B 'could':54B 'databas':58B 'endpoint':46B 'exist':50B 'exploit':49B 'flaw':25B 'getallchartdata':45B 'host':23B 'inject':37B 'java':18B 'jeecgboot':19B,31B 'jimubi':28B 'let':33B 'packag':20B 'param':41B 'public':48B 'read':55B 'remot':35B 'self':22B 'self-host':21B 'sql':38B","search_c":"'/jeecg-boot/drag/onldragdatasethead/getallchartdata':77C '3.9.5':68C 'affect':70C 'argument':87C 'attack':97C,113C 'compon':80C 'contact':117C 'disclosur':121C 'discov':65C 'earli':118C 'exploit':94C,101C 'file':76C 'flaw':62C 'inject':92C 'jeecgboot':67C 'jimubi':81C 'manipul':84C 'may':109C 'param':88C 'part':73C 'perform':82C 'possibl':99C 'public':107C 'releas':104C 'remot':93C 'respond':125C 'result':89C 'secur':61C 'sql':91C 'unknown':72C 'use':111C 'vendor':115C 'way':128C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T02:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124554","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124554","severity":null,"published_at":"2026-11-09T02:16:59+00:00","modified_at":"2026-11-09T02:16:59+00:00","first_seen_at":"2026-11-09T02:24:16+00:00","fetched_at":"2026-11-09T02:24:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124554:2234","url":"https://github.com/jeecgboot/JeecgBoot/releases","severity":null,"published_at":"2026-11-09T02:26:57+00:00","modified_at":"2026-11-09T02:26:57+00:00","first_seen_at":"2026-11-09T02:26:57+00:00","fetched_at":"2026-11-09T02:26:57+00:00","note":"Exa out of credits, NVD page unreadable via WebFetch; no vendor advisory found. JeecgBoot releases page shows v3.9.6 (Nov 5) upgrading Jimu BI to 2.5.6.1 and hardening SQLi generally, but does not name this endpoint/CVE, so no fix claimed. Nothing verified. Exploit/auth requirement unconfirmed (CVSS vector says PR:N, E:P per VulDB). Revisit with working search.","cites":["https://github.com/jeecgboot/JeecgBoot/releases"]}],"documents":[{"id":105306,"url":"https://github.com/jeecgboot/JeecgBoot/releases","title":"JeecgBoot releases (v3.9.6 notes: Jimu BI 2.5.6.1, no mention of getAllChartData)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}