CVE-2026-108774 in JEEWMS
Summary
by MITRE • 10/12/2026
A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The affected element is the function getbinall/getbinallagv of the file src/main/java/com/zzjee/md/controller/MdBinController.java. Executing a manipulation of the argument binstore/binid/des/cengshu can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified within erzhongxmu JEEWMS versions up to 2026.09.27-W39 represents a critical security flaw located specifically within the MdBinController.java file, affecting the getbinall and getbinallagv functions. This software component is responsible for handling bin-related data operations, which are fundamental to inventory management systems that rely on structured database interactions. The core technical issue stems from improper neutralization of special elements used in SQL commands, commonly known as a SQL injection vulnerability. When users or external entities provide input through the arguments binstore, binid, des, and cengshu, these values are not adequately sanitized before being incorporated into dynamic SQL queries. This lack of validation allows an attacker to inject malicious SQL code that alters the intended logic of the database query, potentially granting unauthorized access to sensitive data or allowing manipulation of system records.
From a technical perspective, this flaw aligns with CWE-89, which categorizes Improper Neutralization of Special Elements used in an SQL Command. The vulnerability is exploitable remotely, meaning that an attacker does not need local access to the server hosting the application but can instead launch attacks over a network connection such as the internet or an internal LAN. This remote exploitability significantly increases the risk profile of the vulnerability, as it expands the attack surface beyond trusted environments. The presence of published exploits further exacerbates this threat landscape by lowering the barrier to entry for malicious actors who may lack advanced technical skills but can leverage existing tools to compromise vulnerable instances.
The operational impact of successfully exploiting this SQL injection is severe and multifaceted. An attacker could potentially read, modify, or delete data from the underlying database, leading to data integrity loss and confidentiality breaches. In an inventory management context like JEEWMS, this could result in inaccurate stock levels, financial discrepancies, or complete system unavailability if critical tables are dropped or corrupted. Furthermore, depending on the configuration of the database server, SQL injection vulnerabilities can sometimes be chained with other techniques to achieve remote code execution, thereby providing full control over the host operating system and potentially allowing lateral movement within a corporate network.
The ATT&CK framework classifies this type of vulnerability under T1190: Exploit Public-Facing Application, which describes adversaries leveraging weaknesses in internet-facing software components to gain initial access or escalate privileges. Given that JEEWMS is often deployed as an enterprise resource planning tool accessible via web interfaces, it falls squarely into the category of public-facing applications susceptible to automated scanning and exploitation by threat actors seeking quick wins against poorly secured systems. The fact that vendor contact yielded no response indicates a significant gap in security maintenance practices for this specific software version, leaving users exposed without official patches or guidance on remediation strategies from the original developers.
Mitigation efforts must prioritize immediate isolation of affected instances if they are internet-facing until proper fixes can be implemented. Since the vendor has not provided an update, administrators should consider implementing Web Application Firewalls configured with rules specifically designed to detect and block SQL injection patterns targeting the identified parameters binstore, binid, des, and cengshu. Additionally, code-level remediation requires refactoring the affected Java methods to use parameterized queries or prepared statements instead of string concatenation for building SQL commands. This ensures that user input is treated strictly as data rather than executable code, effectively neutralizing injection attempts regardless of their content. Long-term solutions should involve migrating to a supported version of JEEWMS if available or transitioning to alternative open-source ERP systems with active security maintenance communities and responsive vendor support structures.