CVE-2024-2568 is a medium severity (CVSS 4.7) SQL injection in heyewei JFinalCMS 5.0.0. The Custom Data Page delete function at /admin/div_data/delete takes a divId argument that reaches a query. The record names no fixed version, so check the project. The sections below cover how to check your exposure and what to do.
What's affected
heyewei JFinalCMS 5.0.0, per the record. The affected route is /admin/div_data/delete, in the Custom Data Page component, using the divId argument. The record's score reflects that the route is in the admin area.
The NVD record scores it 4.7 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L, published 2024-03-17. The weakness is classed as CWE-89 (SQL injection).
The record names no fixed version. Check the JFinalCMS repository for a release or commit after 5.0.0 that changes this route.
How to check if you're exposed
Confirm the JFinalCMS version in your build file or admin page. Then look for the route in your logs:
grep -h 'admin/div_data/delete' /var/log/nginx/access.log 2>/dev/null
Requests with unusual divId values deserve a look.
What to do now
- Confirm your JFinalCMS version.
- Check the project for a newer release or fix commit.
- Restrict /admin to trusted networks or a VPN.
- Use bound parameters for the divId query if you maintain a fork.
- Review logs for odd requests to the delete route.
Why it matters
The weakness is SQL injection. Input from the request is placed into a database query without being separated from the query structure, so a crafted value can change what the query does. Depending on the table and the database account, that means reading rows the user was never meant to see, changing records, or in some setups going further.
The reliable fix is the same in every language: parameterised queries, a database account with only the rights the page needs, and server-side validation of types. Filtering bad characters by hand tends to fail. If you run the application and no patched release exists, treat its code as something you must change yourself or take off the network.
This CVE is not on the CISA Known Exploited Vulnerabilities list (the record's KEV flag is false). Exploit details are not repeated here, because this guide is about defence.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages in a project and flags known vulnerabilities, and the Gold directory tracks this CVE. Reachability analysis helps decide which findings in your own code actually matter.
Quick check
Why is the score only 4.7?
The CVSS vector in the record requires high privileges, so the attacker needs an admin session. That lowers the score, but admin accounts are often shared or phished.
Sources
Last reviewed: 19 October 2026.
