JEEWMS SQL Injection and Injection Flaws

SQL injection in the JEEWMS warehouse management system (erzhongxmu JEEWMS through build 2026.09.27-W39) lets an authenticated low-privilege user execute arbitrary SQL by manipulating the 'searchstr' argument handled by WmInQmIController.list in the Inbound Quality Check PDA interface. The vulnerability is remotely reachable (CVSS:4.0 base 2.1; assessed CVSS:3.1 6.3, AV:N/AC:L/PR:L/UI:N with low confidentiality, integrity and availability impact), so the primary constraint on exploitation is that the attacker needs a valid low-privilege account - it is not exploitable by fully unauthenticated parties. Publicly available exploit code exists and the vendor was contacted but never responded, so no vendor patch is currently identified; the issue is not in CISA KEV and real-world priority is low given the authentication prerequisite and the niche deployment footprint of this product.

SQL injection in erzhongxmu JEEWMS (versions up to and including 2026.09.27-W39) lets an authenticated low-privileged user inject arbitrary SQL through the 'searchstr' argument of the WmSttInGoodsController.list endpoint, potentially reading, tampering with, or disrupting warehouse-management data. Publicly available exploit code exists, and the vendor was contacted early but did not respond, so no vendor-released patch has been identified; there is no confirmed active exploitation (CISA KEV). With an assessed CVSS:4.0 base score of 5.3 and low confidentiality, integrity, and availability impact, this is a moderate-priority issue whose main limiting factor is the authentication prerequisite - anonymous, unauthenticated users cannot reach the vulnerable code path.

Authenticated SQL injection in erzhongxmu JEEWMS through version 2026.09.27-W39 allows remote low-privileged users to execute arbitrary SQL via the 'searchstr' parameter in the PDA interface's WmToMoveGoodsController.list endpoint. Publicly available exploit code exists (CVSS 4.0 E:P), though no confirmed active exploitation (CISA KEV) has been reported. The vendor did not respond to disclosure, and no vendor-released patch has been identified, so risk is moderate and depends on limiting exposure of the PDA interface.

SQL injection in the Autocomplete Handler of erzhongxmu JEEWMS (versions up to 2026.09.27-W39) allows remote attackers who already hold a valid low-privilege account to manipulate the trem, searchField, or entityName arguments passed to CommonServiceImpl.getAutoList and execute arbitrary SQL against the backend database, exposing data reachable by that account. Publicly available exploit code exists, so the attack is practical for any user able to authenticate and reach the endpoint; the vector's E:P rating and the reporter's note that the exploit was made public confirm exploitability, though there is no CISA KEV listing indicating confirmed active exploitation. The vendor was contacted early but never responded, and no vendor-released patched version has been identified.