CVE-2026-1546
📋 TL;DR
This SQL injection vulnerability in jishenghua jshERP allows remote attackers to execute arbitrary SQL commands through the barCodes parameter in the getBillItemByParam function. Organizations using jshERP versions up to 3.6 are affected, potentially exposing sensitive database information.
💻 Affected Systems
- jishenghua jshERP
📦 What is this software?
Jsherp by Jishenghua
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data exfiltration, data manipulation, and potential remote code execution via database functions.
Likely Case
Unauthorized access to sensitive business data, inventory information, and potential privilege escalation within the ERP system.
If Mitigated
Limited information disclosure if proper input validation and parameterized queries are implemented.
🎯 Exploit Status
Exploit details are publicly disclosed in GitHub issues, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Vendor has not responded to vulnerability report. Consider migrating to alternative ERP solutions or implementing workarounds.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict input validation for the barCodes parameter to reject SQL injection attempts
Modify /jshERP-boot/depotItem/importItemExcel to validate barCodes parameter against allowed patterns
WAF Rule Implementation
allDeploy web application firewall rules to block SQL injection patterns in requests to the vulnerable endpoint
Configure WAF to block requests containing SQL keywords like UNION, SELECT, INSERT, DELETE, DROP, etc. in the barCodes parameter
🧯 If You Can't Patch
- Isolate the jshERP system from internet access and restrict internal network access
- Implement database-level protections including strict user permissions and query logging
🔍 How to Verify
Check if Vulnerable:
Check if jshERP version is 3.6 or earlier by examining application version files or database schema versionCheck Version:
Check application.properties or similar configuration files for version informationVerify Fix Applied:
Test the /jshERP-boot/depotItem/importItemExcel endpoint with SQL injection payloads in barCodes parameter to confirm they are rejected📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by SQL error messages
- Requests to /jshERP-boot/depotItem/importItemExcel with suspicious barCodes parameters
Network Indicators:
- Unusual outbound database connections from jshERP server
- Large data transfers from jshERP database
SIEM Query:
source="jshERP" AND (url="/jshERP-boot/depotItem/importItemExcel" AND (param="barCodes" AND value CONTAINS "UNION" OR value CONTAINS "SELECT" OR value CONTAINS "--"))🔗 References
- https://github.com/jishenghua/jshERP/
- https://github.com/jishenghua/jshERP/issues/145
- https://github.com/jishenghua/jshERP/issues/145#issue-3816930151
- https://vuldb.com/?ctiid.343230
- https://vuldb.com/?id.343230
- https://vuldb.com/?submit.739688
- https://github.com/jishenghua/jshERP/issues/145
- https://github.com/jishenghua/jshERP/issues/145#issue-3816930151
