Description

A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected is the function WmSttInGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java. Such manipulation of the argument searchstr leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-10-12T01:16:29.617Z",
  "pubdate": "2026-10-12T01:16:29.617Z",
  "executiveSummary": "A critical SQL injection vulnerability has been identified in the erzhongxmu JEEWMS platform, affecting all versions up to 2026.09.27-W39.\nThe vulnerability resides within the WmSttInGoodsController.list function, where insufficient validation of the 'searchstr' input parameter allows for the injection of arbitrary SQL commands.\nThis flaw enables unauthenticated remote attackers to manipulate database queries, potentially leading to unauthorized data exfiltration, modification, or complete compromise of the underlying database instance.\nThe risk is exacerbated by the availability of public exploits, increasing the likelihood of malicious exploitation.\nAs the vendor has failed to respond to disclosure attempts, no official patches are currently available, necessitating immediate implementation of compensating security controls by system administrators to mitigate exposure.",
  "technicalDetails": "The vulnerability is a classic SQL injection flaw located in the src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java file of the JEEWMS application.\nThe root cause is the insecure handling of the 'searchstr' argument passed to the 'list' function within the WmSttInGoodsController class. The application fails to utilize parameterized queries or adequate input sanitization when processing this parameter before incorporating it into a dynamic SQL statement executed against the backend database.\nThe exploitation process involves an attacker supplying a specially crafted 'searchstr' string containing malicious SQL syntax via a remote HTTP request. Because the input is processed unsafely, the database engine interprets the injected SQL fragments as part of the intended query logic.\nAn attacker can leverage this injection point to perform various operations, including but not limited to: bypassing authentication mechanisms, extracting sensitive data from tables, modifying application records, or potentially executing administrative database functions if the application's database service account possesses sufficient privileges.\nThe attack vector is remotely accessible, meaning no physical access or local network presence is required. Given the public availability of exploit material, the attack flow is straightforward: 1) The attacker targets the application endpoint mapped to WmSttInGoodsController.list. 2) The attacker submits a malicious payload via the 'searchstr' query parameter. 3) The server-side code concatenates the unsanitized input directly into an SQL command string. 4) The database server executes the modified query, returning the results of the injection to the attacker or executing the desired command-and-control operations within the database context.\nThe persistence of this vulnerability across versions up to 2026.09.27-W39 suggests a systemic flaw in the handling of search parameters across the JEEWMS controller architecture. Without code-level remediation to enforce strict input validation or the transition to a robust ORM framework that utilizes bind variables by default, the application remains susceptible to persistent exploitation."
}