Description

A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this vulnerability is the function WmToMoveGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmToMoveGoodsController.java of the component PDA Interface. Performing a manipulation of the argument searchstr results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-10-12T01:16:29.783Z",
  "pubdate": "2026-10-12T01:16:29.783Z",
  "executiveSummary": "A critical SQL injection vulnerability exists in the erzhongxmu JEEWMS platform, specifically within the PDA Interface component. This flaw resides in the WmToMoveGoodsController.list function, which fails to properly sanitize user-supplied input provided via the searchstr parameter.\nSuccessful exploitation allows an unauthenticated remote attacker to execute arbitrary SQL queries against the underlying database. This poses a severe risk to confidentiality, integrity, and availability, as unauthorized actors can extract, modify, or delete sensitive data, and potentially escalate privileges or gain control over the database management system.\nThe vulnerability is currently subject to public exploit disclosure, significantly increasing the risk of active exploitation. Despite attempts to notify the vendor, no response or security patch has been provided, leaving affected systems at risk. Organizations utilizing JEEWMS versions up to 2026.09.27-W39 are advised to implement immediate compensating controls to mitigate the potential for unauthorized data access and system compromise.",
  "technicalDetails": "The vulnerability is located within the file src/main/java/com/zzjee/wm/controller/WmToMoveGoodsController.java. The WmToMoveGoodsController.list function processes incoming requests from the PDA Interface component without implementing adequate input validation or parameterization of the 'searchstr' argument.\nThe root cause is identified as the concatenation of unsanitized input directly into a dynamic SQL query string before execution. Because the application fails to utilize prepared statements or parameterized queries, the 'searchstr' parameter acts as an injection vector for malicious SQL command sequences.\nAn attacker can exploit this flaw by crafting an HTTP request containing a crafted 'searchstr' payload. When this payload is processed by the controller, the database engine interprets the malicious input as part of the intended SQL command rather than as data. This allows for 'blind' or 'error-based' SQL injection techniques, enabling the attacker to bypass authentication mechanisms, perform data exfiltration, or execute administrative commands.\nThe attack flow begins with the attacker reaching the publicly accessible PDA interface. By manipulating the 'searchstr' argument, the attacker injects SQL syntax (e.g., UNION SELECT, boolean-based inference, or time-based payloads). Since the PDA component is exposed remotely, no prior authentication is required to initiate the attack sequence, assuming the interface is reachable over the network. The application backend then executes the modified query against the database, returning sensitive records or executing unintended database operations based on the attacker's input.\nThe impact of a successful exploitation is critical, as it can lead to full database compromise. Depending on the database user permissions, the attacker may be able to read system configuration files, access sensitive user data, or modify records to disrupt logistics and warehouse operations. Because the flaw exists in a core controller handling goods management, the integrity of inventory data is specifically at high risk."
}