CVE-2025-51742

Critical

Published: 25/11/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

In JSH_ERP 2.3.1, the /material/getMaterialEnableSerialNumberList endpoint passes the search parameter directly to parseObject(), introducing a Fastjson deserialization vulnerability that can lead to RCE via JDBC payloads.

Risk Assessment

A remote attacker can execute arbitrary code on the server, leading to full compromise of the ERP system and data.

Recommendation

Upgrade to a patched version immediately and restrict access to the endpoint.

Original NVD description (English source)

An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to parseObject(), introducing a Fastjson deserialization vulnerability that can lead to RCE via JDBC payloads.