CVE-2026-108775 in JEEWMS
Summary
by MITRE • 10/12/2026
A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the function WvNoticeController.list of the file com/zzjee/wmapi/controller/WvNoticeController.java of the component Search Endpoint. The manipulation of the argument searchstr leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in erzhongxmu JEEWMS, specifically affecting versions up to 2026.09.27-W39, represents a critical security flaw within the application's search functionality. The issue resides in the WvNoticeController.list method located in the file com/zzjee/wmapi/controller/WvNoticeController.java. This component serves as the primary entry point for users to query notice data through a dedicated Search Endpoint. The core technical deficiency is an SQL injection vulnerability triggered by improper handling of the searchstr argument. When this parameter is processed, the application fails to adequately sanitize or validate user-supplied input before incorporating it into database queries. Consequently, an attacker can inject malicious SQL code that alters the intended logic of the query, allowing for unauthorized data access, modification, or destruction within the backend database system.
From a technical perspective, this flaw aligns with CWE-89, which categorizes Improper Neutralization of Special Elements used in an SQL Command. The absence of parameterized queries or strict input validation allows external control over the structure of SQL statements executed by the application server. This type of vulnerability is particularly dangerous because it does not require complex exploitation techniques; standard SQL injection payloads can be utilized to extract sensitive information such as user credentials, personal data, or proprietary business logic stored in the database. The fact that remote exploitation is possible significantly increases the risk profile, as attackers do not need local access or authentication privileges on the target system to initiate an attack vector against this endpoint.
The operational impact of this vulnerability extends beyond simple data exfiltration. Successful exploitation can lead to a complete compromise of the underlying database infrastructure. Attackers may leverage tools like sqlmap to automate the extraction process, potentially leading to full server takeover if the database service runs with elevated privileges or has network access to other critical systems within the enterprise architecture. Furthermore, since the exploit code has been disclosed publicly and is available for use by threat actors, the window of opportunity for malicious exploitation is immediate and broad. Organizations relying on this version of JEEWMS are exposed to a high probability of attack from automated scanning bots that actively search for known vulnerable endpoints using public exploit signatures.
The vendor's lack of response despite early notification exacerbates the risk environment. Without an official patch or mitigation guidance, administrators must rely on defensive measures and workarounds until a fixed version is released. This situation highlights the importance of maintaining up-to-date software inventories and monitoring for security advisories from multiple sources when primary vendors are unresponsive. The community-driven disclosure ensures that awareness exists but places the burden of immediate protection squarely on the organization's security operations team.
To mitigate this risk, organizations should implement Web Application Firewall rules designed to detect and block SQL injection patterns targeting the WvNoticeController.list endpoint. Network segmentation can also help limit lateral movement in case an initial breach occurs. Additionally, reviewing database access permissions ensures that even if successful exploitation takes place, the blast radius is contained by adhering to the principle of least privilege. Long-term remediation requires upgrading to a patched version once available or refactoring the affected Java code to use prepared statements with parameterized queries for all user inputs. Continuous monitoring and logging should be enhanced to detect anomalous database query patterns that may indicate ongoing exploitation attempts aligned with ATT&CK techniques such as T1059 Command and Scripting Interpreter or T1078 Valid Accounts if credential theft occurs via the injection vector.