CVE-2024-53499

An attacker can submit a crafted HTTP request to the CgReportController API endpoint by injecting malicious SQL code. The lack of proper validation or parameterization of input data causes the injected code to be directly interpreted by the database engine. The attack does not require having an account in the system or user interaction, and it can be carried out remotely over the network.

An attacker can gain unauthorized access to sensitive data stored in the database, modify or delete data, and depending on the database server configuration—potentially take control of the system. The vulnerability threatens the confidentiality, integrity, and availability of the system.

Patches available from the vendor should be applied according to the references. As a temporary measure, it is recommended to restrict network access to the CgReportController API interface and monitor logs for suspicious SQL queries.

Jeewms v3.7