CVE-2026-3028
📋 TL;DR
A stored cross-site scripting (XSS) vulnerability exists in erzhongxmu JEEWMS up to version 3.7, specifically in the doAdd function of JeecgListDemoController.java. This allows remote attackers to inject malicious scripts via the Name parameter, which are then executed when other users view the affected content. Organizations using JEEWMS versions up to 3.7 are affected.
💻 Affected Systems
- erzhongxmu JEEWMS
📦 What is this software?
Jeewms by Huayi Tec
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, deface the application, or redirect users to malicious sites, potentially leading to account compromise and data theft.
Likely Case
Attackers inject malicious scripts that execute in victims' browsers, potentially stealing session tokens or performing unauthorized actions within the application.
If Mitigated
With proper input validation and output encoding, malicious scripts would be neutralized before execution, preventing successful exploitation.
🎯 Exploit Status
The exploit has been publicly disclosed and requires user interaction (viewing malicious content). Attack vector is remote.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a version above 3.7 if available, or implement workarounds.
🔧 Temporary Workarounds
Input Validation and Output Encoding
allImplement proper input validation for the Name parameter and ensure all user-controlled output is properly encoded before rendering.
Modify src/main/java/com/jeecg/demo/controller/JeecgListDemoController.java to sanitize the Name parameter
Content Security Policy (CSP)
allImplement a strict Content Security Policy header to mitigate XSS impact by restricting script execution sources.
Add Content-Security-Policy header to web server configuration
🧯 If You Can't Patch
- Implement a Web Application Firewall (WAF) with XSS protection rules
- Disable or restrict access to the vulnerable demo controller component if not needed
🔍 How to Verify
Check if Vulnerable:
Check if JEEWMS version is 3.7 or earlier and if the JeecgListDemoController.java file exists with the vulnerable doAdd function.Check Version:
Check application version in web interface or configuration filesVerify Fix Applied:
Test the Name parameter with XSS payloads to ensure they are properly sanitized or encoded in output.📡 Detection & Monitoring
Log Indicators:
- Unusual or malicious script patterns in Name parameter values in application logs
Network Indicators:
- HTTP requests containing script tags or JavaScript in Name parameter
SIEM Query:
web_requests WHERE url_path CONTAINS 'jeecgListDemoController' AND parameters CONTAINS '<script' OR 'javascript:'