Description

A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The affected element is the function getbinall/getbinallagv of the file src/main/java/com/zzjee/md/controller/MdBinController.java. Executing a manipulation of the argument binstore/binid/des/cengshu can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-10-12T00:17:01.200Z",
  "pubdate": "2026-10-12T00:17:01.200Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in the erzhongxmu JEEWMS software, affecting versions up to 2026.09.27-W39.\nThe flaw resides in the MdBinController component and allows remote, unauthenticated attackers to manipulate database queries via unsanitized input parameters.\nSuccessful exploitation enables unauthorized database access, potentially leading to data exfiltration, manipulation of sensitive records, or total compromise of the underlying database server.\nGiven that the vulnerability is publicly disclosed with functional exploits available and the vendor has remained unresponsive to disclosure attempts, this flaw poses a significant and immediate security risk to deployments.\nOrganizations using the affected versions of JEEWMS are exposed to remote compromise and should prioritize risk mitigation strategies immediately.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw located within the MdBinController class of the JEEWMS application. Specifically, the affected functions are 'getbinall' and 'getbinallagv' defined in 'src/main/java/com/zzjee/md/controller/MdBinController.java'.\nThe root cause of this vulnerability is the improper neutralization of user-supplied input before incorporating it into SQL queries. The application fails to utilize parameterized queries or appropriate prepared statements when processing parameters identified as 'binstore', 'binid', 'des', and 'cengshu'.\nAn attacker can exploit this by crafting malicious HTTP requests that inject arbitrary SQL syntax into these parameters. Because the application processes these inputs directly within the backend database query, the database interpreter executes the injected malicious SQL commands with the privileges of the application's database user account.\nThe attack flow proceeds as follows: 1) The attacker identifies the exposed endpoint associated with 'getbinall' or 'getbinallagv'. 2) The attacker crafts a request containing a specially formulated payload designed to alter the query logic (e.g., using UNION-based injection, error-based injection, or blind injection techniques). 3) The request is transmitted to the JEEWMS server. 4) The server-side controller takes the malicious input and concatenates it directly into the SQL statement. 5) The database executes the modified query, returning unintended data or performing unauthorized actions.\nThis vulnerability is reachable remotely over the network without requiring prior authentication or specific privileges, significantly lowering the barrier for exploitation. The potential post-exploitation impact includes the bypass of authentication mechanisms, unauthorized extraction of sensitive business data, modification or deletion of data within the warehouse management system, and potentially the execution of commands on the database server if the database configuration permits such operations (e.g., via xp_cmdshell or similar features).\nAs an exploit has been published, automated scanning and exploitation tools are likely to be weaponized against this vulnerability, making it an urgent priority for security teams to address."
}