CVE-2024-24001

2024-02-0600:00:00

mitre

www.cve.org

jsherp

sql injection

vulnerability

com.jsh.erp.controller.depotheadcontroller

baseresponseinfo

findallocationdetail

protection mechanism

AI Score

9.9

Confidence

High

EPSS

0.001

Percentile

33.0%

JSON

jshERP v3.3 is vulnerable to SQL Injection. via the com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findallocationDetail() function of jshERP which allows an attacker to construct malicious payload to bypass jshERP’s protection mechanism.