CVE-2026-108781: erzhongxmu JEEWMS PDA WmToMoveGoodsController.java WmToMoveGoodsController.list sql injection
A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this vulnerability is the function WmToMoveGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmToMoveGoodsController.java of the component PDA Interface. Performing a manipulation of the argument searchstr results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be initiated remotely and has low attack complexity, but the severity vector indicates that the attacker needs low-level privileges. No user interaction is required.
Which deployments are affected?
The affected component is the PDA Interface, specifically the WmToMoveGoodsController.list function. Erzhongxmu JEEWMS versions up to 2026.09.27-W39 are affected.
What input should be investigated for exploitation attempts?
Investigate requests to the PDA Interface that invoke WmToMoveGoodsController.list and include manipulation of the searchstr argument. The vulnerability is SQL injection through that argument.
How urgent is remediation?
A public exploit has been released and may be used in attacks. The vendor reportedly did not respond to early disclosure contact, so organizations should not assume a vendor fix is available.