217 matches found
CVE-2024-24001
jshERP v3.3 is vulnerable to SQL Injection. via the com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findallocationDetail function of jshERP which allows an attacker to construct malicious payload to bypass jshERP's protection mechanism...
CVE-2024-24001
jshERP v3.3 is vulnerable to SQL Injection. via the com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findallocationDetail function of jshERP which allows an attacker to construct malicious payload to bypass jshERP's protection mechanism...
jshERP SQL Injection Vulnerability
jshERP Huaxia ERP is a homegrown ERP system by the personal developer of Ji Sheng Hua in China. A SQL injection vulnerability exists in jshERP v3.3. An attacker can exploit this vulnerability to build a malicious payload to bypass jshERP's protection mechanism...
PT-2024-20226 · Jsherp · Jsherp
Name of the Vulnerable Software and Affected Versions: jshERP version 3.3 Description: The issue concerns an Arbitrary File Upload vulnerability. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulti...
CVE-2024-24000
jshERP v3.3 is vulnerable to Arbitrary File Upload. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulting in arbitrary file uploads with controllable paths...
CVE-2024-24004
jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutDetail function of jshERP does not filter column and order parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection...
CVE-2024-24002
jshERP v3.3 is affected by an SQL injection in the MaterialController.getListWithStock() function. The vulnerability stems from inadequate filtering of the column and order parameters, allowing crafted input to bypass the safeSqlParse protection. No exploitation details are provided in the availa...
CVE-2024-24001
jshERP v3.3 is vulnerable to SQL Injection. via the com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findallocationDetail function of jshERP which allows an attacker to construct malicious payload to bypass jshERP's protection mechanism...
CVE-2024-24004
CVE-2024-24004 affects jshERP v3.3. The vulnerability arises in com.jsh.erp.controller.DepotHeadController.findInOutDetail() where safeSqlParse does not properly filter the column and order parameters, enabling SQL injection by crafting a malicious payload. Impact is described as high/critical (C...
CVE-2024-24004
jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutDetail function of jshERP does not filter column and order parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection...
There are 4 sql injection vulnerabilities and 1 file upload vulnerability in jshERP v3.3
public static String safeSqlParseString originStr re...
CVE-2023-48894
Incorrect Access Control vulnerability in jshERP V3.3 allows attackers to obtain sensitive information via the doFilter function...
Improper access control
Incorrect Access Control vulnerability in jshERP V3.3 allows attackers to obtain sensitive information via the doFilter function...
CVE-2023-48894
Incorrect Access Control vulnerability in jshERP V3.3 allows attackers to obtain sensitive information via the doFilter function...
jshERP Security Vulnerabilities
jshERP Huaxia ERP is a homegrown ERP system by the personal developer of Ji Sheng Hua in China. A security vulnerability exists in jshERP version V3.3, which originates from an Access Control Error vulnerability. An attacker can exploit this vulnerability to obtain sensitive information via the...
CVE-2023-48894
The CVE-2023-48894 entry concerns jshERP v3.3 and is caused by incorrect access control in the doFilter function, enabling attackers to obtain sensitive information. Affected software: jshERP 3.3. Documented impact is information disclosure without exploitation details. Remediation guidance from ...