CVE-2025-51742
CriticalSummary
In JSH_ERP 2.3.1, the /material/getMaterialEnableSerialNumberList endpoint passes the search parameter directly to parseObject(), introducing a Fastjson deserialization vulnerability that can lead to RCE via JDBC payloads.
Risk Assessment
A remote attacker can execute arbitrary code on the server, leading to full compromise of the ERP system and data.
Recommendation
Upgrade to a patched version immediately and restrict access to the endpoint.
Other vulnerabilities in JSH_ERP
See all- CVE-2025-51746Critical
In JSH_ERP 2.3.1, the /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks, potentially allowing remote code execution.
- CVE-2025-51745Critical
In JSH_ERP 2.3.1, the /role/addcan endpoint is vulnerable to fastjson deserialization attacks, potentially allowing remote code execution.
- CVE-2025-51744Critical
In JSH_ERP 2.3.1, the /user/addUser endpoint is vulnerable to fastjson deserialization attacks, potentially allowing remote code execution.
- CVE-2025-51743Critical
In JSH_ERP 2.3.1, the /materialCategory/addMaterialCategory endpoint is vulnerable to fastjson deserialization attacks, potentially allowing remote code execution.
Original NVD description (English source)
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /material/getMaterialEnableSerialNumberList endpoint passes the search query parameter directly to parseObject(), introducing a Fastjson deserialization vulnerability that can lead to RCE via JDBC payloads.