CVE-2025-7566
📋 TL;DR
This critical vulnerability in jshERP allows remote attackers to perform path traversal attacks via the Title parameter in the exportExcelByParam function. Attackers can potentially read or write files outside the intended directory. All users running jshERP versions up to 3.5 are affected.
💻 Affected Systems
- jshERP
📦 What is this software?
Jsherp by Jishenghua
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Unauthorized file read/write operations, potentially exposing sensitive configuration files or user data.
If Mitigated
Limited impact with proper file system permissions and input validation controls in place.
🎯 Exploit Status
Proof of concept available on GitHub with detailed reproduction steps.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor was contacted but did not respond.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation to reject path traversal sequences in the Title parameter.
Implement server-side validation to block '../', '..\', and similar sequences
Web Application Firewall Rule
allBlock requests containing path traversal patterns in the Title parameter.
Configure WAF to block requests with '../' or similar patterns in parameters
🧯 If You Can't Patch
- Restrict file system permissions to limit what the application can access
- Implement network segmentation to isolate the jshERP instance
🔍 How to Verify
Check if Vulnerable:
Test the /src/main/java/com/jsh/erp/controller/SystemConfigController.java endpoint with path traversal payloads in the Title parameter.Check Version:
Check jshERP version in application configuration or admin interface.Verify Fix Applied:
Verify that path traversal attempts are blocked and return appropriate error responses.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with '../' or similar patterns in Title parameter
- File access errors for unexpected paths
Network Indicators:
- Unusual file export requests to the SystemConfigController endpoint
SIEM Query:
source="web_server" AND (uri="*SystemConfigController*" AND param="*../*")