CVE-2026-108773

Executive Summary

CVE-2026-108773 is a SQL injection vulnerability in erzhongxmu JEEWMS, an open-source warehouse management system, affecting versions up to 2026.09.27-W39. The flaw resides in the docheck function of src/main/java/com/zzjee/wm/controller/WmOmNoticeHController.java, where manipulation of the goodscode argument allows an attacker to inject arbitrary SQL. A public exploit exists and the attack is remotely initiable, though it requires low-privileged authenticated access (CVSS 6.3). Because the vendor has not responded or issued a fix, any internet-facing JEEWMS deployment is at risk with no official remediation available.

Technical Analysis

JEEWMS is a Java-based warehouse management system (WMS) built on the JEE platform (Spring MVC / Hibernate lineage common to Chinese enterprise Java stacks). The vulnerable endpoint is handled by WmOmNoticeHController in the com.zzjee.wm.controller package. The specific function docheck accepts a goodscode argument that is passed to a database query without adequate parameterization, enabling SQL injection (CWE-74, Improper Neutralization of Special Elements in Output Used by a Downstream Component, subclass of SQL injection).

The attack surface is the web-facing notice/check endpoint. The docheck function is typically invoked to validate or check a goods code during outbound/inbound notice processing in the WMS workflow. Because the goodscode parameter is the sole injection vector identified, an attacker with a valid low-privileged session (PR:L) can send crafted input to alter query semantics. The NVD description does not specify whether the injection is error-based, boolean-based, union-based, or time-based — no public PoC is available in the provided intelligence to confirm the exact technique. The CVSS vector indicates low confidentiality, integrity, and availability impact (C:L/I:L/A:L), consistent with a scoped SQL injection that may permit partial data disclosure or limited data manipulation rather than full database takeover. No authentication bypass is implied; the attacker must already possess low-privileged credentials (PR:L).

The vulnerability was disclosed after the vendor was contacted early but did not respond. This is a classic unresponsive-vendor scenario common to niche open-source enterprise projects, meaning no official patch or advisory exists. The affected version boundary is "up to 2026.09.27-W39," implying the project uses date-based build tags rather than semantic versioning; any deployment at or below that build is presumed vulnerable.

Exploitation Scenarios

Because no public exploit code or PoC is provided, the following chain is inferred strictly from the vulnerability class (SQL injection) and the NVD description. No specific implementation details beyond docheck, goodscode, and the controller path are asserted.

1. Reconnaissance / Target Identification. An attacker locates an exposed JEEWMS instance (e.g., via Shodan using http.html:"JEEWMS" or http.title:"JEEWMS"). The attacker identifies the notice/check endpoint associated with WmOmNoticeHController and the docheck action. Since exploitation is authenticated (PR:L), the attacker obtains low-privileged credentials — through default accounts, prior phishing, credential reuse, or a separate low-severity issue — or self-registers if the deployment permits account creation.

2. Triggering the Flaw Class. The attacker sends a request that invokes the docheck function and supplies a malicious value in the goodscode argument. Because the value is concatenated into a SQL statement without proper sanitization/parameterization, the attacker can alter the query's logic.

3. Payload / Execution (class level). At the SQL injection class level, the attacker supplies a crafted goodscode value designed to break out of the expected literal context and append SQL syntax. Depending on the database backend and result reflection, this may be a boolean-based, union-based, error-based, or stacked payload. The attacker iterates on the payload to extract data or modify records. No specific payload string is asserted here because none is available in the provided intelligence.

4. Post-Exploitation Impact. Successful injection allows the attacker to read or manipulate warehouse data (inventory, goods codes, notices) subject to the database account's privileges. Given the CVSS impact subscores (C:L/I:L/A:L), the expected outcome is limited data disclosure and limited integrity/availability impact rather than comprehensive database compromise. The attacker may pivot to further internal systems if the WMS database account is over-privileged.

Impact Assessment

• Business impact: JEEWMS manages warehouse inventory, goods movement, and logistics notices. SQL injection into the check routine can expose or corrupt inventory and notice data, potentially disrupting warehouse operations and providing attackers a foothold into the corporate data tier.
• Affected systems: Any JEEWMS deployment up to build 2026.09.27-W39, particularly internet-facing or partner-accessible instances.
• Blast radius: Scoped by CVSS as low for confidentiality, integrity, and availability (C:L/I:L/A:L), but real-world blast radius depends on database privilege configuration. An over-privileged application DB account could amplify the impact beyond the rated vector.
• Exploit maturity: Public exploit exists ("The exploit is now public and may be used"), raising urgency despite the moderate base score. No CISA KEV listing and no EPSS score (not yet scored by FIRST.org).
• Patch status: Unpatched (confidence 0/4). No vendor fix, no workarounds documented. This is the dominant risk multiplier.

Detection Guidance

Sigma Rule

title: JEEWMS WmOmNoticeHController docheck SQL Injection Attempt
id: 8f3a1c2e-9b47-4d5a-a1c9-7e6b2d4f0a11
status: experimental
description: Detects SQL injection attempts against the goodscode parameter of the docheck function in WmOmNoticeHController (CVE-2026-108773)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108773
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: java
detection:
  selection_endpoint:
    cs-uri-stem|contains: 'WmOmNoticeHController'
  selection_action:
    cs-uri-query|contains: 'docheck'
  selection_payload:
    cs-uri-query|contains:
      - 'goodscode='
      - "'"
      - "' or '"
      - 'union select'
      - 'waitfor delay'
      - 'sleep('
      - '--'
  condition: selection_endpoint and selection_action and selection_payload
falsepositives:
  - Legitimate goods codes containing apostrophes
level: high

YARA Rule

rule CVE_2026_108773_JEEWMS_SQLi
{
    meta:
        description = "Detects SQL injection payloads targeting JEEWMS docheck goodscode parameter"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108773"
        author = "valtersit.com"
        date = "2026-01-01"
        cve = "CVE-2026-108773"

    strings:
        $endpoint = "WmOmNoticeHController" ascii wide nocase
        $func     = "docheck" ascii wide nocase
        $param    = "goodscode" ascii wide nocase
        $sqli1    = "union select" ascii wide nocase
        $sqli2    = "' or '" ascii wide nocase
        $sqli3    = "waitfor delay" ascii wide nocase
        $sqli4    = "sleep(" ascii wide nocase

    condition:
        ($endpoint or $func or $param) and any of ($sqli*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108773 JEEWMS docheck goodscode SQL Injection Attempt"; flow:established,to_server; http.uri; content:"WmOmNoticeHController"; nocase; http.uri; content:"docheck"; nocase; http.uri; content:"goodscode"; nocase; pcre:"/(goodscode[^&]*(%27|')|union(%20|\s)+select|waitfor(%20|\s)+delay|sleep\()/i"; reference:cve,2026-108773; classtype:web-application-attack; sid:2026108773; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [url.path : "*WmOmNoticeHController*" and url.query : "*docheck*"]
  [url.query : ("*goodscode*" and ("*union select*" or "*' or '*" or "*waitfor delay*" or "*sleep(*"))]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access
| where match(uri, "(?i)WmOmNoticeHController") AND match(uri, "(?i)docheck") AND match(uri, "(?i)goodscode")
| regex uri="(?i)(union(\+|%20|\s)+select|'\s*or\s*'|waitfor(\+|%20|\s)+delay|sleep\s*\(|%27)"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, status
| sort - count

Wazuh OSSEC Rule

<group name="web,jeeWMS,sqli,">
  <rule id="108773" level="12">
    <if_sid>31100</if_sid>
    <match>WmOmNoticeHController</match>
    <match>docheck</match>
    <regex>goodscode=.*(union|select|waitfor|sleep|%27|')</regex>
    <description>CVE-2026-108773: JEEWMS docheck goodscode SQL injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor was contacted early but did not respond; there is no official fix, advisory, or documented workaround.

1. Immediate mitigations:

   • Restrict network exposure: place JEEWMS behind a VPN or reverse proxy with allow-listed source IPs; do not expose the notice/check endpoint to the public internet.
   • Enforce strong authentication and least-privilege accounts; the attack requires low-privileged access, so eliminate default/shared credentials and rotate all WMS accounts.
   • Apply a WAF rule (virtual patch) blocking SQL metacharacters and known injection patterns in the goodscode parameter for the docheck/WmOmNoticeHController route.
   • Audit and restrict the database account used by JEEWMS to the minimum required privileges (no DDL, no xp_cmdshell, no stacked queries where avoidable).
   • Monitor logs for exploitation attempts using the detection rules above and consider temporary disabling of the affected check feature if it is non-essential.

2. Patch/upgrade steps:

   • No official patch exists. Track the upstream erzhongxmu JEEWMS repository for a security fix and apply it as soon as it is released.
   • If you maintain a fork, remediate the docheck function directly by replacing string concatenation of goodscode with parameterized queries/prepared statements.
   • Contact the vendor or maintainers to request a security advisory and CVE remediation.

3. Long-term hardening:

   • Conduct source-level review of all controllers (starting with com.zzjee.wm.controller) for string-concatenated SQL and convert to parameterized queries.
   • Deploy a SAST/DAST pipeline in CI to catch SQL injection before release.
   • Implement centralized, tamper-evident logging and continuous vulnerability monitoring for this product given the vendor's non-responsiveness.
   • Adopt a software bill of materials (SBOM) and track open-source enterprise dependencies with known unpatched CVEs.

References

• NVD — CVE-2026-108773: https://nvd.nist.gov/vuln/detail/CVE-2026-108773
• CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component: https://cwe.mitre.org/data/definitions/74.html
• erzhongxmu JEEWMS project repository (upstream source, watch for fix): https://github.com/erzhongxmu/JEEWMS
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-108773 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No threat actor campaigns or exploit-in-the-wild evidence were provided in the intelligence data; no attribution is asserted. The exploit is reported as public, but no specific exploitation campaign is confirmed.