Description

A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiController.list of the file src/main/java/com/zzjee/wmapi/controller/WvGiController.java. The manipulation of the argument searchstr results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-10-12T00:17:01.533Z",
  "pubdate": "2026-10-12T00:17:01.533Z",
  "executiveSummary": "The JEEWMS application, developed by erzhongxmu, contains a critical SQL injection vulnerability in the WvGiController.list function.\nThis flaw allows remote, unauthenticated attackers to manipulate the 'searchstr' parameter to inject arbitrary SQL commands into the backend database queries.\nThe vulnerability affects all versions up to 2026.09.27-W39.\nSuccessful exploitation grants an attacker the ability to bypass application security controls, potentially leading to unauthorized data exfiltration, modification, or deletion within the underlying database.\nGiven that public exploits exist and the vendor has not provided a response or patch, the risk level is considered high, necessitating immediate defensive measures to prevent system compromise.",
  "technicalDetails": "The vulnerability resides in the src/main/java/com/zzjee/wmapi/controller/WvGiController.java file, specifically within the list method handling the 'searchstr' argument.\nThe root cause of this vulnerability is the improper sanitization and neutralization of user-supplied input before it is incorporated into a dynamic SQL query.\nIn the affected function, the 'searchstr' input is concatenated directly into the database query string without the use of parameterized queries or prepared statements, which are standard security controls for preventing SQL injection.\nThe attack flow begins when an attacker sends a crafted HTTP request to the vulnerable endpoint associated with the WvGiController.list method.\nBy injecting malicious SQL syntax (such as UNION-based, blind, or error-based payloads) into the 'searchstr' argument, the attacker can alter the query logic executed by the backend database management system (DBMS).\nBecause the input is processed server-side, the DBMS executes the modified query within the application's security context. This allows the attacker to query tables they are not authorized to access, extract sensitive data, or potentially execute administrative commands depending on the database user's privileges.\nThis vulnerability is classified as a remote SQL injection, meaning no prior authentication or local access is required to initiate the attack; the application is exposed to network-based threats.\nThe lack of input validation and the absence of an ORM (Object-Relational Mapping) layer using parameterized inputs in the affected controller allow for full control over the query structure.\nPost-exploitation impacts include, but are not limited to, complete database compromise, unauthorized access to user records, intellectual property theft, and potential persistence mechanisms within the database environment.\nAs public exploit code is currently available, the barrier to entry for potential attackers is significantly lowered, increasing the likelihood of active exploitation attempts against internet-facing JEEWMS instances."
}