Lucene search

MitreCVE-2024-24001

HistoryFeb 07, 2024 - 12:15 a.m.

CVE-2024-24001

2024-02-0700:15:56

CWE-89

mitre

web.nvd.nist.gov

jsherp

v3.3

sql injection

cve-2024-24001

nvd

security vulnerability

com.jsh.erp.controller.depotheadcontroller

com.jsh.erp.utils.baseresponseinfo

findallocationdetail() function

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

33.0%

JSON

jshERP v3.3 is vulnerable to SQL Injection. via the com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findallocationDetail() function of jshERP which allows an attacker to construct malicious payload to bypass jshERP’s protection mechanism.

Affected configurations

Nvd

Node

jishenghuajsherpMatch3.3

VendorProductVersionCPE
jishenghuajsherp3.3cpe:2.3:a:jishenghua:jsherp:3.3:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
jishenghua	jsherp	3.3	cpe:2.3:a:jishenghua:jsherp:3.3:::::::*

References

github.com/cxcxcxcxcxcxcxc/cxcxcxcxcxcxcxc/blob/main/cxcxcxcxcxc/about-2024/24001.txt

github.com/jishenghua/jshERP/issues/99

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.001

Percentile

33.0%

JSON

Related for CVE-2024-24001