EUVD-2026-97064
GHSA-6m96-h9v3-q5rx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Jeewms application
-
ExploitSubmit crafted searchVal to getTreeData autocomplete handler
-
ExecutionBreak out of HQL 'like' clause
-
ImpactExfiltrate database records
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session (PR:L) with access to the Autocomplete Data Handler, specifically the getTreeData function in src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java, reached via a form field that feeds the 'searchVal' parameter into an HQL 'like' query. Exploitation is limited by the need for valid application credentials and by the endpoint residing in a demo/sample controller (com.jeecg.demo) that may not be exposed or enabled in all deployments; no special non-default server configuration is otherwise required. Affected versions are Jeewms up to and including 3.7. |
| Impact | This is a moderate, authentication-gated SQL/HQL injection rather than a top-priority emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores 5.3 (Medium): remotely reachable with low complexity and no user interaction, but it requires at least low-level privileges (PR:L), meaning an attacker must already be authenticated to the Jeewms application. The impact is rated Low across confidentiality, integrity, and availability, which is conservative for injection - note the source diff shows the flaw is HQL (Hibernate) string concatenation in a 'like' clause, not raw SQL, which somewhat constrains but does not eliminate data-exfiltration potential. No EPSS score, KEV listing, or POC flag is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The strongest real-world signal is the confirmed vendor patch (commit 6e29bd57), which authoritatively validates the vulnerability's existence. Overall: a real but second-tier issue - the authentication requirement and niche product footprint reduce urgency well below the headline of a 'remote SQL injection.' |
| Exploit ScenarioDerived | An authenticated user of the Jeewms warehouse management system navigates to an autocomplete-backed form field and submits a crafted 'searchVal' value that breaks out of the HQL 'like' clause, altering the query to disclose TSUser records or other data beyond the intended autocomplete scope. No public exploit code is identified in the provided data, though the patch diff and VulDB advisory make the injection point trivially reproducible for anyone with account access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
SQL injection in JeeWMS up to and including 3.7 lets an authenticated remote user inject arbitrary HQL through the 'searchVal' parameter of the getTreeData function in JeecgFormDemoController.java, allowing manipulation of the underlying database query. Exploitation requires a valid application session with access to the Autocomplete Data Handler endpoint, which resides in a demo/sample controller (com.jeecg.demo) that may not be exposed in every deployment, so this is a moderate, authentication-gated issue rather than an emergency; no public exploit code has been identified at time of analysis and no EPSS score was provided. The upstream project has published a fix in commit 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 (PR #4), which switches the vulnerable string concatenation to a parameterized query.
RemediationAI
Apply the upstream fix: merge or adopt commit 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0 (PR https://github.com/erzhongxmu/JeeWMS/pull/4), which converts the vulnerable HQL string concatenation in getTreeData to a parameterized query using a '?' placeholder and a bound Object[] argument - this is the authoritative correction and no separately tagged patched release is independently confirmed, so verify the commit is present in whatever build you deploy. If you cannot patch immediately, compensating controls are: disable or remove the JeecgFormDemoController demo/sample controller from the deployed application, or block external routing to its Autocomplete/getTreeData endpoint, since the component is demo code and is not typically required in production (trade-off: any internal feature relying on that demo autocomplete will stop working, and removal must be repeated on each redeploy unless done in source). Additionally, restrict the endpoint to trusted authenticated roles and require strong credentials, because exploitation is gated by PR:L and a valid session; note that restricting access only raises the bar for attackers who already hold an account and does not fix the underlying injection. General remediations such as a WAF rule for SQL/HQL metacharacters in the searchVal parameter can add detection but should not be treated as a substitute for the parameterization fix. Consult https://github.com/Lib0gus/JeeWMS/security/advisories/GHSA-mc7c-w398-v7xp and https://vuldb.com/vuln/416392 for further details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-89 SQL injection that manifests specifically as an HQL (Hibernate Query Language) injection inside the JeeWMS Java web application, which is built on the Jeecg/JEECG framework. In JeecgFormDemoController.getTreeData, user-controlled input (searchVal) was concatenated directly into an HQL 'like' expression - "from TSUser where userName like '%" + searchVal + "%'" - and then passed to systemService.findHql(hql). Because the value is inserted into the query string before parsing rather than bound as a parameter, an attacker who can reach this handler can break out of the LIKE literal and alter the query structure, reading or manipulating data the HQL executes against (TSUser maps to the user table). The fix replaces the concatenation with a placeholder ("from TSUser where userName like ?") and passes the wildcard-wrapped value as a bound Object[] argument, which is the standard parameterization defense. CPE cpe:2.3:a:erzhongxmu:jeewms:*:*:*:*:*:*:*:* with no version bounds reflects that the project's versioning simply treats all releases up to 3.7 as affected. The CVSS v4.0 vector supplied by the source (AV:N/AC:L/AT:N/PR:L/UI:N with low C/I/A) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) agree that the attacker must hold credentials (PR:L) and that the realistic impact is limited confidentiality, integrity, and availability loss.
Know when Jeewms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Network-reachable injection with low complexity, but a valid low-privilege authenticated account is required (PR:L); impact kept Low/unscoped to match the HQL 'like'-clause injection evidenced in the patch.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData of the file src/main/java/com/jeecg/demo/controller/JeecgFormDemoController.java of the component Autocomplete Data Handler. Performing a manipulation of the argument searchVal results in sql injection. The attack can be initiated remotely. The patch is named 6e29bd57972a499e9c8a81a2dbe94d0d5cf23af0. It is recommended to apply a patch to fix this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component. R
Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information vi
A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms 3.7. Rated medium severity (CVSS 6.9), this v
A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute a
Jeewms 3.7 contains a server-side request forgery vulnerability in the UEditor plugin's getRemoteImage.jsp file, where t
Code injection in erzhongxmu JeeWMS via the JimuReport test-connection endpoint (/base-boot/jmreport/testConnection) all
Unauthenticated remote access to the Spring Boot Actuator endpoint in erzhongxmu JeeWMS exposes sensitive application in
A vulnerability was found in erzhongxmu Jeewms up to 20241108. Rated medium severity (CVSS 5.3), this vulnerability is r
A vulnerability was found in Guangzhou Huayi Intelligent Technology Jeewms up to 1.0.0 and classified as critical.html o
JEEWMS 1.0 is vulnerable to SQL Injection. Attackers can inject malicious SQL statements through the id1 and id2 paramet
Reflected cross-site scripting in Jeewms up to version 3.7 exists in the UEditor component's getContent.jsp file through
Cross-site scripting (XSS) in the doAdd function of Jeewms up to version 3.7 allows unauthenticated remote attackers to
Exploit-DB