CVE-2026-108684

Executive Summary

CVE-2026-108684 is an authenticated SQL injection vulnerability in erzhongxmu Jeewms versions up to and including 3.7. The flaw resides in the getTreeData function of src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java, within the Autocomplete Data Handler component, where manipulation of the searchVal argument permits SQL injection. Successful exploitation requires only low privileges and network access, resulting in limited confidentiality, integrity, and availability impact (CVSS 6.3).

Technical Analysis

The vulnerability affects the Jeewms platform, a Java-based warehouse/enterprise management application built on the JeecgBoot rapid-development framework. JeecgBoot exposes a suite of demonstration and utility controllers, one of which is JeecgFormDemoController. Within this controller, the getTreeData handler processes a parameter identified as searchVal — most commonly the request string supplied by an autocomplete/tree-lookup UI widget.

The defect class is CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, i.e., injection), with the practical realization taking the form of SQL injection. The Autocomplete Data Handler takes the client-supplied searchVal and incorporates it into a database query without adequate parameterization or sanitization. Because searchVal reaches a SQL interpreter as untrusted input, an attacker can alter the intended query semantics — appending predicates, subqueries, or boolean constructs that the developer did not intend.

Key technical observations:

• Attack surface: An HTTP endpoint backed by JeecgFormDemoController.getTreeData. The parameter of interest is searchVal.
• Privilege requirement: CVSS vector PR:L indicates the endpoint is reachable by an authenticated user holding low privileges; anonymous access is not assumed.
• Network reachability: AV:N confirms remote exploitation over the network.
• Scope: S:U means the vulnerable component and impacted component are the same; the exploit does not inherently chain privilege escalation across security boundaries at the framework level, though database-level impact is possible.
• Impact triad: C:L/I:L/A:L reflect partial impact to each dimension — consistent with a query-injection flaw where read access, mutation of data, or query-driven resource consumption are all plausible but constrained.

The NVD text references a patch commit named 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0. However, no vendor advisory, tagged release, or monitored source independently confirms a shipped fix, therefore the patch confidence is assessed as 0/4 and the issue is treated as UNPATCHED. No public PoC, Nuclei template, or exploit code is available; the attack chain below is inferred from the vulnerability class.

Exploitation Scenarios

No public PoC is available; the following chain is inferred from the SQL injection vulnerability class and the parameters named in the NVD description.

1. Reconnaissance / target identification. An attacker enumerates internet-exposed Jeewms deployments (JeecgBoot-based applications are frequently deployed on Tomcat/embedded Spring Boot engines). Fingerprinting relies on distinctive static assets, login pages, and default application paths. The attacker identifies an installation at or below version 3.7.

2. Authentication and endpoint discovery. Because the CVSS vector requires low privileges (PR:L), the attacker first obtains a valid low-privileged account — via self-registration, a default credential, or a previously compromised session. The attacker then locates the Autocomplete Data Handler endpoint that maps to getTreeData in JeecgFormDemoController and observes that it accepts a searchVal parameter.

3. Triggering the flaw (vulnerability-class level). The attacker crafts a request in which searchVal carries SQL metacharacters and injection syntax instead of a legitimate autocomplete substring. Because the value is not safely bound, the database parses the injected tokens as part of the query. The exact payload syntax depends on the backend database (e.g., quote-breaking and boolean/UNION constructs, or time-delay functions for blind confirmation). The analyst should note: the description confirms injection through searchVal but does not disclose the precise query construction, so specific payload strings are not asserted here.

4. Post-exploitation impact. Depending on database privileges and the underlying DBMS, outcomes include: reading data the low-privileged user should not access (confidentiality), modifying or deleting rows (integrity), and inducing latency or denial via heavy queries (availability) — matching the C:L/I:L/A:L subscores. In the worst case, if the JDBC connection uses an over-privileged database account, the injection could extend to broader data exfiltration.

Impact Assessment

• Business impact: Jeewms underpins warehouse and enterprise data workflows. SQL injection in an autocomplete handler can expose inventory, order, and user records, or allow integrity tampering with business data.
• Affected systems: Any Jeewms deployment at version ≤ 3.7 exposing the JeecgFormDemoController autocomplete endpoint, particularly internet-reachable instances.
• Blast radius: Bound to the application's database connection and its privileges. The S:U scope limits cross-boundary chaining, but database-level exposure remains significant. The low privileges required (PR:L) lower the bar for insider or low-tier authenticated attackers.
• CVSS subscores: AV:N (remote), AC:L (no special conditions), PR:L (needs a low-priv account), UI:N (no victim interaction), S:U (same component), and C:L/I:L/A:L (partial impact across all three dimensions) — a moderate 6.3 overall.

Detection Guidance

Sigma Rule

title: Jeewms getTreeData SQL Injection Attempt (CVE-2026-108684)
id: 9f3c1a2e-7b4d-4c8a-9e21-jeewms108684
status: experimental
description: Detects SQL injection attempts targeting the searchVal parameter of the Jeewms Autocomplete Data Handler (getTreeData).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108684
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - 'JeecgFormDemoController'
      - 'getTreeData'
  selection_payload:
    cs-uri-query|contains:
      - 'searchVal='
    cs-uri-query|contains|any:
      - "'"
      - '"'
      - '--'
      - 'union'
      - 'select'
      - 'sleep('
      - 'benchmark('
  condition: selection_endpoint and selection_payload
falsepositives:
  - Legitimate search strings containing apostrophes
level: high

YARA Rule

rule CVE_2026_108684_Jeewms_SQLi
{
    meta:
        description = "Detects SQL injection attempts against Jeewms getTreeData searchVal parameter"
        cve = "CVE-2026-108684"
        author = "Threat Intelligence"
        date = "2026-01-01"
    strings:
        $ctrl = "JeecgFormDemoController" ascii nocase
        $fn   = "getTreeData" ascii nocase
        $p1   = "searchVal" ascii nocase
        $sqli_union  = "union select" ascii nocase
        $sqli_comment = "/*" ascii
        $sqli_sleep  = "sleep(" ascii nocase
        $sqli_bench  = "benchmark(" ascii nocase
    condition:
        ($ctrl or $fn) and $p1 and 1 of ($sqli_*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108684 Jeewms getTreeData SQL Injection Attempt"; flow:to_server,established; http.uri; content:"getTreeData"; nocase; http.uri; content:"searchVal"; nocase; pcre:"/(searchVal=[^&]*(%27|'|%22|--|union|select|sleep\(|benchmark\())/i"; reference:cve,2026-108684; class type:web-application-attack; sid:2026108684; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [ network where http.request.method == "GET" and
      http.request.uri : ("getTreeData" or "JeecgFormDemoController") and
      http.request.uri : "searchVal" ]
  [ network where http.request.uri : ("searchVal" and ("'" or "union" or "select" or "sleep(" or "benchmark(")) ]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path IN ("*JeecgFormDemoController*","*getTreeData*") OR uri_query="*searchVal=*"
| rex field=uri_query "searchVal=(?<searchval>[^&]+)"
| where match(searchval, "(?i)(%27|'|%22|\"|--|union|select|sleep\(|benchmark\()")
| stats count min(_time) as first_seen max(_time) as last_seen values(searchval) as payloads by src_ip, uri_path
| where count > 3

Wazuh OSSEC Rule

<group name="web,sql_injection,jeewms,">
  <rule id="108684" level="12">
    <if_sid>31100</if_sid>
    <id>^%3F</id>
    <match>getTreeData|JeecgFormDemoController</match>
    <regex>searchVal=.*(?:%27|'|%22|--|union|select|sleep\(|benchmark\()</regex>
    <description>CVE-2026-108684: Possible SQL injection attempt against Jeewms getTreeData searchVal parameter</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict network access to Jeewms administrative/controller endpoints; do not expose the application to untrusted networks.
   • Enforce strict authorization on the Autocomplete Data Handler so only the minimum required roles reach getTreeData.
   • Insert a WAF rule blocking requests where searchVal contains SQL metacharacters and injection keywords.
   • Reduce the privileges of the application's database account (read-only where feasible) to limit blast radius.

2. Patch/upgrade steps

   • Track upstream Jeewms/JeecgBoot releases for a fix referencing commit 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0. Because no vendor advisory confirms a shipped patch, treat any version as potentially vulnerable until verified.
   • When a fix is published, upgrade to the first release that contains the commit and validate that getTreeData uses parameterized queries.
   • If the codebase is self-maintained, audit JeecgFormDemoController.getTreeData and replace any string concatenation of searchVal with prepared statements/bound parameters.

3. Long-term hardening

   • Adopt a secure coding standard mandating parameterized queries for all database access.
   • Conduct SAST/DAST scans targeting injection sinks in controllers and DAO layers.
   • Apply least privilege to database accounts and enable query logging/alerting for anomalous SQL.
   • Maintain a patch management cadence and CVE monitoring for the JeecgBoot dependency chain.

References

• NVD — CVE-2026-108684: https://nvd.nist.gov/vuln/detail/CVE-2026-108684
• NVD CWE-74 (Injection): https://cwe.mitre.org/data/definitions/74.html
• Jeewms project repository (erzhongxmu/jeewms): https://github.com/erzhongxmu/jeewms
• Referenced patch commit: 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0
• CISA KEV Catalog (no entry for CVE-2026-108684 as of this writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No exploit-in-the-wild evidence, threat actor campaign attribution, or public PoC is currently available for this CVE.