Critical severity9.8NVD Advisory· Published Feb 7, 2024· Updated Jun 17, 2026

CVE-2024-24002

Description

jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.MaterialController: com.jsh.erp.utils.BaseResponseInfo getListWithStock() function of jshERP does not filter column and order parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in safeSqlParse method for sql injection.

Affected products

jshERP/jshERPcpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: =3.3

Patches

Vulnerability mechanics

References

github.com/jishenghua/jshERP/issues/99nvdExploitVendor Advisory
github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/24002.txtnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000