CVE-2025-70311
📋 TL;DR
JEEWMS 1.0 contains a SQL injection vulnerability in the /systemControl.do interface where attackers can inject malicious SQL through id1 and id2 parameters. This allows unauthorized database access and manipulation. All users running JEEWMS 1.0 are affected.
💻 Affected Systems
- JEEWMS
📦 What is this software?
Jeewms by Huayi Tec
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, and potential remote code execution via database functions
Likely Case
Data exfiltration, privilege escalation, and unauthorized access to sensitive business information
If Mitigated
Limited impact with proper input validation and database permissions, but still poses authentication bypass risk
🎯 Exploit Status
SQL injection is a well-understood attack vector with many automated tools available
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://gitee.com/erzhongxmu/JEEWMS
Restart Required: No
Instructions:
No official patch available. Check the Gitee repository for updates and apply parameterized queries or input validation.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with SQL injection rules to block malicious requests
Input Validation Filter
allImplement server-side validation to reject suspicious id1 and id2 parameter values
🧯 If You Can't Patch
- Isolate the JEEWMS system from internet access and restrict internal network access
- Implement strict database permissions and monitor for unusual SQL queries
🔍 How to Verify
Check if Vulnerable:
Test /systemControl.do endpoint with SQL injection payloads in id1 or id2 parameters and observe database errors or unexpected responsesCheck Version:
Check application version in web interface or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and that parameterized queries are implemented📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in application logs
- Multiple requests to /systemControl.do with suspicious parameter values
- Database queries with unexpected UNION or SELECT statements
Network Indicators:
- HTTP requests to /systemControl.do containing SQL keywords in parameters
- Unusual database connection patterns from application server
SIEM Query:
source="web_logs" AND uri="/systemControl.do" AND (param="id1" OR param="id2") AND (value="UNION" OR value="SELECT" OR value="OR" OR value="--")