CVE Catalog
CVE-2025-51745
CriticalSummary
In JSH_ERP 2.3.1, the /role/addcan endpoint is vulnerable to fastjson deserialization attacks, potentially allowing remote code execution.
Risk Assessment
The vulnerability could allow an attacker to take control of the system, including modifying roles and user permissions.
Recommendation
Update the system and restrict access to the /role/addcan endpoint. Monitor logs for suspicious requests.
Original NVD description (English source)
An issue was discovered in jishenghua JSH_ERP 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks.