CVE-2025-5384
📋 TL;DR
CVE-2025-5384 is a critical SQL injection vulnerability in JeeWMS that allows remote attackers to execute arbitrary SQL commands through the /cgAutoListController.do?datagrid endpoint. This affects all JeeWMS installations up to May 4, 2025. Attackers can potentially access, modify, or delete database content.
💻 Affected Systems
- JeeWMS
📦 What is this software?
Jeewms by Huayi Tec
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection to RCE chaining.
Likely Case
Unauthorized data access, data exfiltration, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited. The public issue tracker contains technical details that could facilitate exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 20250504
Vendor Advisory: https://gitee.com/erzhongxmu/JEEWMS/issues/IC5FNV
Restart Required: Yes
Instructions:
1. Update to the latest JeeWMS version after May 4, 2025. 2. Restart the application server. 3. Verify the fix by testing the vulnerable endpoint.
🔧 Temporary Workarounds
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns targeting /cgAutoListController.do?datagrid
Endpoint Restriction
allRestrict access to the vulnerable endpoint using network controls or application configuration
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in the CgAutoListController function
- Deploy network segmentation to isolate JeeWMS from critical databases and limit attack surface
🔍 How to Verify
Check if Vulnerable:
Test the /cgAutoListController.do?datagrid endpoint with SQL injection payloads or check if version is before May 4, 2025Check Version:
Check JeeWMS version in application interface or configuration filesVerify Fix Applied:
Test the endpoint with SQL injection payloads after update and verify they are rejected📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed login attempts after SQL injection attempts
- Requests to /cgAutoListController.do?datagrid with SQL syntax
Network Indicators:
- Unusual database connections from application server
- Large data transfers from database
SIEM Query:
source="jeeWMS" AND (url="*/cgAutoListController.do*" AND (payload="*SELECT*" OR payload="*UNION*" OR payload="*OR*"))