Description

A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. Impacted is the function docheck of the file src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java. Performing a manipulation of the argument goodscode results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-10-11T23:16:56.917Z",
  "pubdate": "2026-10-11T23:16:56.917Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the erzhongxmu JEEWMS application, affecting versions up to 2026.09.27-W39.\nThe vulnerability resides within the docheck function of the WmOmNoticeHController.java file, where the goodscode parameter fails to properly sanitize user-supplied input before being incorporated into database queries.\nThis flaw allows remote, unauthenticated, or authenticated attackers to manipulate SQL commands, potentially leading to unauthorized data exfiltration, modification, or destruction of the underlying database content.\nGiven that the exploit is public and the vendor remains unresponsive, the risk is elevated as malicious actors can readily weaponize this vulnerability against deployed instances.\nThe impact encompasses complete compromise of the database tier, which may serve as a pivot point for further lateral movement within the network infrastructure.\nImmediate defensive measures are required to isolate vulnerable instances and implement strict input validation to prevent arbitrary query execution.",
  "technicalDetails": "The vulnerability is a classic SQL injection (SQLi) flaw located within the controller logic of the JEEWMS application. Specifically, the function docheck in src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java is susceptible to input manipulation via the goodscode argument.\nThe root cause of this issue is improper neutralization of special elements used in an SQL command. The application accepts the goodscode parameter directly from the HTTP request and concatenates it into a dynamic SQL query string without employing parameterized queries (prepared statements) or sufficient input validation/filtering.\nThe exploitation flow initiates with an attacker crafting a malicious HTTP request targeting the affected controller endpoint. By injecting SQL meta-characters and command syntax into the goodscode field, the attacker can break out of the intended query structure. For example, by supplying a payload such as ' OR 1=1 --, the attacker can alter the query logic to bypass authentication checks or force the application to return unintended data sets.\nBecause the vulnerable code exists at the controller level, the injection occurs prior to the database abstraction layer processing. This exposes the database to arbitrary command execution. Depending on the database permissions configured for the JEEWMS service account, an attacker could potentially perform unauthorized CRUD operations, query system-level information, or even execute administrative stored procedures.\nThe vulnerability is remotely exploitable, requiring no specific administrative privileges to initiate the attack. As the exploit vector is now public, automated scanners and threat actors can easily discover and compromise exposed instances. The attack does not require complex infrastructure, relying primarily on the manipulation of standard web traffic parameters.\nPost-exploitation, the impact is severe. Since the application likely handles logistics and warehouse management data, the compromise of the database could result in the leakage of sensitive supply chain information, unauthorized access to user credentials, or the modification of inventory records. In environments where the application server shares network segments with more sensitive backend systems, this SQLi could serve as an initial foothold for broader environment exploitation."
}