JEEWMS EUVD-2026-97136

Exploitation requires an authenticated session with at least low-level privileges (PR:L) to reach the Autocomplete Handler, then manipulation of the trem, searchField, or entityName arguments passed to CommonServiceImpl.getAutoList. No user interaction is needed and the endpoint is reachable over the network. Limiting factors: the attacker must hold valid application credentials (not unauthenticated), the affected product (erzhongxmu JEEWMS, versions up to 2026.09.27-W39) has a narrow deployment base, and no vendor fix exists - so mitigation depends on restricting account access, input validation, or network exposure rather than patching.

This is a CWE-89 SQL injection in the Autocomplete Handler (CommonServiceImpl.getAutoList) of JEEWMS, an open-source Java warehouse management system. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation requiring authenticated low privileges (PR:L), with Exploit maturity E:P (proof-of-concept). The vendor-assigned base score is 5.3 (Medium), tempered by the fact that each impact metric is rated Low (VC:L/VI:L/VA:L). This impact rating appears conservative for SQL injection, which commonly permits broad database read/extraction - the real confidentiality impact may be understated, so this should be treated as a genuine data-exposure risk rather than dismissed on the 5.3 score alone. Countervailing the severity: a VulDB-provided public exploit exists (POC), but there is NO CISA KEV listing and NO EPSS score in the input, so there is no evidence of widespread or active exploitation - publicly available exploit code is a distinct and lower signal than confirmed in-the-wild use. The PR:L requirement is a meaningful limiter: an attacker needs valid (even low-level) application credentials. Net: a credible, patch-worthy priority for anyone running JEEWMS with untrusted authenticated users, but not an emergency-grade internet-wide threat given the niche product footprint and lack of KEV/EPSS corroboration.

An authenticated low-privilege user sends a crafted request to the JEEWMS autocomplete endpoint, manipulating the trem, searchField, or entityName parameters consumed by CommonServiceImpl.getAutoList, injecting SQL that the backend executes against the database. Because a public proof-of-concept exploit has been released, an attacker with any valid account could reuse it to enumerate and extract database contents (e.g., user records or credentials) remotely over the network.