A SQL injection flaw exists in the JeecgBoot backend component, triggered through manipulation of the create_by parameter in the /jeecgboot/sys/dict/loadDict endpoint. The vulnerability allows an attacker to inject arbitrary SQL code into database queries, potentially leading to data theft, data modification, or denial of service. The flaw corresponds to CWE-74 and CWE-89, both relating to unsanitized input being passed to SQL statements.

The issue affects deployments of JeecgBoot up to and including version 3.9.1. No other versions are listed as impacted. The vendor product is the JeecgBoot backend interface for dictionary loading.

The CVSS score is 5.3, indicating a medium severity risk. The EPSS score is below 1%, suggesting low current exploitation probability, and the vulnerability is not catalogued in the CISA KEV list. However, the flaw can be exploited remotely via a publicly disclosed exploit, so an attacker with network access to the vulnerable endpoint could gain unauthorized database access.