Deer WMS 2 CVE-2025-8124

Upgrade Deer WMS 2 to a version newer than 3.3 when available from the vendor. If an immediate upgrade is not feasible, implement the following compensating controls: (1) Restrict network access to the /system/role/authUser/unallocatedList endpoint to a whitelist of trusted administrative IP addresses using a WAF or reverse proxy, reducing exposure to unauthorized users; (2) Apply database-level least-privilege principles by ensuring the application's database user account has SELECT permissions only on required tables and no direct INSERT/UPDATE/DELETE on role tables, limiting SQL injection blast radius to read-only data exfiltration; (3) Enable comprehensive SQL query logging and monitoring on the database server to detect and alert on unusual SQL patterns indicative of injection attempts; (4) Conduct an audit of user account privileges to remove unnecessary administrative roles from standard user accounts, since the vulnerability requires authentication. Monitor the official Gitee repository (https://gitee.com/deerwms/deer-wms-2) for patch release announcements and apply promptly upon availability.