CVE Catalog
CVE-2025-51744
CriticalSummary
In JSH_ERP 2.3.1, the /user/addUser endpoint is vulnerable to fastjson deserialization attacks, potentially allowing remote code execution.
Risk Assessment
An attacker could add unauthorized users or take over existing accounts, compromising system integrity.
Recommendation
Update JSH_ERP and restrict access to the /user/addUser endpoint. Implement input filtering as well.
Original NVD description (English source)
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /user/addUser endpoint is vulnerable to fastjson deserialization attacks.