CVE-2024-24003: SQL Injection

Published Feb 8, 2024

Updated

jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutMaterialCount() function of jshERP does not filter column and order parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in safeSqlParse method for sql injection.

Affected Software

1 affected component

jishenghua jshERP=3.3

Event History

Feb 8, 2024

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·02:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-24003?

CVE-2024-24003 has a high severity rating due to its potential for SQL Injection attacks.

How do I fix CVE-2024-24003?

To fix CVE-2024-24003, ensure that all user inputs for the 'column' and 'order' parameters are properly sanitized and validated.

What are the potential impacts of CVE-2024-24003?

The potential impacts of CVE-2024-24003 include unauthorized access to the database and manipulation of data due to SQL Injection.

Which versions of jshERP are affected by CVE-2024-24003?

jshERP version 3.3 is the only version affected by CVE-2024-24003.

Is there an exploit available for CVE-2024-24003?

Yes, there are known exploits for CVE-2024-24003 that demonstrate how attackers can leverage SQL Injection vulnerabilities.