Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-24003: Attackers can run database commands in jshERP 3.3

CVE-2024-24003 · published 2 years ago

Summary

The jshERP version 3.3 web application does not properly check the column and order inputs in a specific function, allowing a malicious user to insert their own SQL code. This could let an attacker view, change, or delete data stored in the system's database. Apply the vendor's security update or patch the input validation as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
jishenghua	jsherp	3.3 `cpe:2.3:a:jishenghua:jsherp:3.3:::::::*`

Original advisory text

jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutMaterialCount() function of jshERP does not filter `column` and `order` parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in `safeSqlParse` method for sql injection.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24003... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-24003 Vendor Advisory
https://github.com/jishenghua/jshERP/issues/99 Third Party Advisory
https://github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2... URL

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published8 Feb 2024

Updated4 Nov 2026

First seen14 Mar 2026

Sources

CVE-2024-24003 · OSV

CVE-2024-24003 · NVD

Track software like this

Free during beta