Description

A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the function WvNoticeController.list of the file com/zzjee/wmapi/controller/WvNoticeController.java of the component Search Endpoint. The manipulation of the argument searchstr leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-10-12T00:17:01.370Z",
  "pubdate": "2026-10-12T00:17:01.370Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in the erzhongxmu JEEWMS system, affecting versions up to 2026.09.27-W39.\nThe vulnerability resides within the Search Endpoint functionality, specifically targeting the 'searchstr' argument in the WvNoticeController.list function.\nThis flaw allows remote, unauthenticated attackers to execute arbitrary SQL commands against the backend database, potentially leading to unauthorized data exfiltration, modification, or total system compromise.\nThe vulnerability is currently public, and given the lack of vendor response, affected systems are at high risk of exploitation.\nSuccessful exploitation allows attackers to bypass application-level security controls, interact directly with the database, and potentially escalate privileges or compromise the underlying server infrastructure.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw located in the com/zzjee/wmapi/controller/WvNoticeController.java file, within the WvNoticeController.list method.\nThe root cause is the improper neutralization of special elements used in an SQL command within the 'searchstr' argument. The application fails to utilize parameterized queries or adequate input validation when processing this parameter, allowing user-supplied input to be concatenated directly into a database query string.\nWhen a remote attacker provides a specially crafted 'searchstr' parameter, the malicious payload modifies the structure of the intended SQL query. By injecting standard SQL syntax, such as UNION SELECT statements or boolean-based blind injection primitives, an attacker can manipulate the query logic.\nThe attack flow begins with the attacker identifying the target endpoint exposed by the WvNoticeController. The attacker then crafts an HTTP request containing the malicious SQL payload within the 'searchstr' parameter. Upon processing the request, the JEEWMS application executes the corrupted SQL command against the connected database management system (DBMS).\nBecause the application executes the query with the privileges of the database user configured in the connection string, the impact is highly dependent on the database permissions. In scenarios where the application connects as a privileged user (e.g., 'sa' or 'root'), the attacker can potentially perform administrative actions, drop tables, or read sensitive data from unrelated tables within the database schema.\nThe vulnerability is remotely exploitable without the requirement for prior authentication or elevated privileges, making it a severe risk for any public-facing instance of JEEWMS.\nThe public disclosure of exploit material significantly lowers the barrier to entry for attackers, increasing the probability of active exploitation in the wild."
}