JSH_ERP vulnerabilities

In JSH_ERP 2.3.1, the /serialNumber/addSerialNumber endpoint is vulnerable to fastjson deserialization attacks, potentially allowing remote code execution.

In JSH_ERP 2.3.1, the /role/addcan endpoint is vulnerable to fastjson deserialization attacks, potentially allowing remote code execution.

In JSH_ERP 2.3.1, the /user/addUser endpoint is vulnerable to fastjson deserialization attacks, potentially allowing remote code execution.

In JSH_ERP 2.3.1, the /materialCategory/addMaterialCategory endpoint is vulnerable to fastjson deserialization attacks, potentially allowing remote code execution.

In JSH_ERP 2.3.1, the /material/getMaterialEnableSerialNumberList endpoint passes the search parameter directly to parseObject(), introducing a Fastjson deserialization vulnerability that can lead to RCE via JDBC payloads.