Description

A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. This impacts the function WmInQmIController.list of the file src/main/java/com/zzjee/wm/controller/WmInQmIController.java of the component Inbound Quality Check Pda Interface. This manipulation of the argument searchstr causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-10-12T00:17:01.700Z",
  "pubdate": "2026-10-12T00:17:01.700Z",
  "executiveSummary": "A SQL injection vulnerability has been identified in erzhongxmu JEEWMS up to version 2026.09.27-W39. The flaw specifically affects the Inbound Quality Check Pda Interface component located in the source file src/main/java/com/zzjee/wm/controller/WmInQmIController.java within the WmInQmIController.list function. This security issue arises due to improper handling and insufficient sanitization of the user-supplied searchstr argument.\nA remote attacker can exploit this vulnerability without physical access by crafting malicious network requests that manipulate the searchstr parameter. Successful exploitation allows attackers to execute arbitrary SQL commands directly against the underlying database. This capability grants adversaries the ability to extract sensitive records, modify or delete database contents, bypass application controls, and compromise overall system integrity.\nBecause a public exploit for this vulnerability has been publicly disclosed and is actively available, the risk of automated scanning and exploitation is high. Despite early notification regarding this disclosure, the vendor did not respond, meaning official patches may not be available. Organizations utilizing erzhongxmu JEEWMS are advised to immediately inspect network traffic, restrict access to the affected endpoint, and implement temporary defensive controls to mitigate potential remote exploitation.",
  "technicalDetails": "The SQL injection vulnerability in erzhongxmu JEEWMS up to version 2026.09.27-W39 originates within the Inbound Quality Check Pda Interface component. Specifically, the vulnerability resides in the application file src/main/java/com/zzjee/wm/controller/WmInQmIController.java within the WmInQmIController.list controller function. The primary root cause is the failure to properly sanitize, validate, or parameterize input passed through the searchstr argument prior to its inclusion in dynamic SQL statements executed by the persistence layer.\nWhen the application processes a request targeting the list functionality within WmInQmIController, the user-controlled searchstr parameter is accepted and concatenated directly into an active database query string. Because the input parameter lacks strict contextual encoding or structural enforcement via Prepared Statements, structural SQL metacharacters submitted within searchstr are parsed and interpreted as executable code by the relational database engine.\nThe attack flow for exploiting this vulnerability operates remotely over the network as follows: 1. The attacker identifies the remote web endpoint mapped to the WmInQmIController.list function within the Inbound Quality Check Pda Interface. 2. The attacker constructs an HTTP request containing a tailored SQL payload injected into the searchstr parameter. 3. The application receives the incoming request and passes the unvalidated searchstr argument to the lower-level data access logic inside src/main/java/com/zzjee/wm/controller/WmInQmIController.java. 4. The constructed dynamic query string is forwarded to the database server, where the embedded payload alters the query logic. 5. The database executes the injected commands, returning unauthorized data, executing data definition or manipulation operations, or revealing underlying database structures through response manipulation.\nBecause the attack vector is purely remote and requires no direct physical access, adversaries can script automated tools to scan and exploit exposed JEEWMS instances. Public disclosure of the exploit code significantly elevates the immediate exposure, as threat actors can leverage ready-to-use payloads to target unpatched deployments.\nThe technical impact of a successful attack extends to complete loss of confidentiality, integrity, and availability regarding the host database. Threat actors can perform data exfiltration, extract credentials, tamper with inventory or operational records, or leverage database administrative roles to execute secondary attacks against the hosting server infrastructure."
}