CVE-2024-24004: Improper Neutralization of Special Elements used in an SQL Command

jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutDetail function of jshERP does not filter column and order parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection...

CVE-2024-24004

jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutDetail function of jshERP does not filter column and order parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection...

PT-2024-20230 · Jsherp · Jsherp

Name of the Vulnerable Software and Affected Versions: jshERP version 3.3 Description: The issue concerns a SQL Injection vulnerability. Specifically, the findInOutDetail function in com.jsh.erp.controller.DepotHeadController does not adequately filter the column and order parameters, allowing an...

CVE-2024-24004

CVE-2024-24004 affects jshERP v3.3. The vulnerability arises in com.jsh.erp.controller.DepotHeadController.findInOutDetail() where safeSqlParse does not properly filter the column and order parameters, enabling SQL injection by crafting a malicious payload. Impact is described as high/critical (C...