CVE-2026-108774

Executive Summary

CVE-2026-108774 is an SQL injection vulnerability in erzhongxmu JEEWMS, an open-source warehouse management system (WMS) built on the JEE platform. The flaw resides in the getbinall / getbinallagv functions of MdBinController.java, where the binstore, binid, des, and cengshu parameters are not properly sanitized before being incorporated into SQL queries. A remote, authenticated attacker can exploit this to manipulate database queries, potentially reading, modifying, or deleting sensitive warehouse and business data. The vendor has not released a patch, and a public exploit has been published, increasing the risk of active exploitation.

Technical Analysis

The vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), with a specific instance of SQL injection (CWE-89). The affected code is located in src/main/java/com/zzjee/md/controller/MdBinController.java, specifically the getbinall and getbinallagv methods. These functions accept user-supplied parameters — binstore, binid, des, and cengshu — which are likely used to filter or retrieve bin (storage location) data from the database. Because these parameters are not sanitized or parameterized, an attacker can inject arbitrary SQL fragments.

The attack surface is the web interface exposed by JEEWMS, typically accessible over HTTP/HTTPS. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L indicates that exploitation requires network access, low attack complexity, low privileges (the attacker must be authenticated, though default or weak credentials may be common), no user interaction, and results in low confidentiality, integrity, and availability impact. The scope is unchanged, meaning the vulnerable component and the affected database are within the same security authority.

The public exploit likely leverages the HTTP request parameters mapped to these function arguments. For example, a request to an endpoint invoking getbinall with a crafted binid parameter could inject SQL code. Without the vendor's response, the exact endpoint and parameter names are not officially documented, but the NVD description explicitly names the function arguments, which are presumed to be the HTTP parameter names. The lack of authentication hardening and input validation are root causes.

Exploitation Scenarios

1. Reconnaissance/Target Identification: The attacker scans the internet for JEEWMS instances using Shodan dorks such as http.title:"JEEWMS" or http.html:"jeewms". They identify the login page or API endpoints. Since the vulnerability requires authentication (PR:L), the attacker may attempt default credentials (e.g., admin/admin) or use previously obtained low-privileged credentials.

2. Triggering the Flaw: After authenticating, the attacker sends a crafted HTTP request to the endpoint that invokes getbinall or getbinallagv. They manipulate one or more of the parameters binstore, binid, des, or cengshu by appending SQL injection payloads. For example, a parameter value like 1' OR '1'='1 or 1; SELECT ... could alter the query logic. The exact HTTP method (GET/POST) and URL path are not specified in the NVD description, but they are part of the application's controller mapping.

3. Payload/Execution Method: The attacker injects SQL syntax to bypass input validation. Common techniques include union-based injection to extract data from other tables, boolean-based blind injection to infer information, or stacked queries if the database supports them (e.g., MySQL). The injected payload is executed by the backend database, allowing the attacker to read arbitrary data from the JEEWMS database.

4. Post-Exploitation Impact: Successful exploitation can lead to unauthorized access to sensitive data such as user credentials, inventory records, supplier information, and business logic. The attacker could modify or delete data (I:L), potentially disrupting warehouse operations (A:L). The low confidentiality impact suggests limited data exposure per query, but repeated exploitation could aggregate significant information. The attacker might also use the SQL injection to escalate privileges within the application or pivot to other systems if the database user has excessive permissions.

Impact Assessment

The CVSS score of 6.3 (Medium) reflects a balance of low impacts across confidentiality, integrity, and availability, with network accessibility and low privileges required. For organizations using JEEWMS, the business impact includes potential data breaches (exposure of inventory, orders, and user data), data integrity issues (manipulation of stock levels or bin assignments), and operational disruption (denial of service via database overload or data corruption). The blast radius is limited to the JEEWMS application and its database, but if the database is shared or contains sensitive PII, the impact could be broader. Given the public exploit and unpatched status, the risk is elevated for exposed instances.

Detection Guidance

Sigma Rule

title: JEEWMS SQL Injection Attempt via MdBinController
id: 3a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: Detects SQL injection attempts targeting the getbinall or getbinallagv functions in JEEWMS.
author: Threat Intelligence Team
date: 2026/10/27
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection:
    cs-uri-query|contains:
      - 'binstore='
      - 'binid='
      - 'des='
      - 'cengshu='
  keywords:
    - 'getbinall'
    - 'getbinallagv'
  condition: selection and keywords
fields:
  - clientip
  - cs-uri-query
  - cs-method
falsepositives:
  - Legitimate administrative use of bin management with unusual characters
level: high
tags:
  - attack.t1190
  - cve.2026-108774

YARA Rule

rule CVE_2026_108774_JEEWMS_SQLi
{
    meta:
        description = "Detects SQL injection patterns in HTTP requests targeting JEEWMS MdBinController"
        author = "Threat Intelligence Team"
        date = "2026-10-27"
        reference = "CVE-2026-108774"
        severity = "high"
    strings:
        $func1 = "getbinall" ascii nocase
        $func2 = "getbinallagv" ascii nocase
        $param1 = "binstore" ascii nocase
        $param2 = "binid" ascii nocase
        $param3 = "des" ascii nocase
        $param4 = "cengshu" ascii nocase
        $sqli1 = /(\%27)|(\')|(\-\-)|(\%23)|(#)/ ascii
        $sqli2 = /((\%3D)|(=))[^\n]*((\%27)|(\')|(\-\-)|(\%3B)|(;))/ ascii
        $sqli3 = /\w*((\%27)|(\'))((\%6F)|o|(\%4F))((\%72)|r|(\%52))/ ascii
    condition:
        (any of ($func*)) and (any of ($param*)) and (any of ($sqli*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108774 JEEWMS SQL Injection Attempt (MdBinController)"; flow:to_server,established; content:"getbinall"; http_uri; nocase; content:"binstore"; http_uri; nocase; pcre:"/(\%27)|(\')|(\-\-)|(\%23)|(#)/Ui"; reference:cve,2026-108774; classtype:web-application-attack; sid:2026108774; rev:1;)

Elastic Detection

sequence by process.entity_id
  [network where process.name == "java" and
   network.direction == "inbound" and
   stringContains(network.protocol, "http") and
   stringContains(url.query, "binstore") and
   stringContains(url.query, "binid") and
   stringContains(url.query, "getbinall")]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="/jeewms/*" OR uri_path="*MdBinController*"
| where match(uri_query, "getbinall") AND match(uri_query, "(binstore|binid|des|cengshu)=")
| eval sqli_indicators = if(match(uri_query, "(?i)(\%27|\'|\-\-|\%23|\%3B|\bOR\b|\bUNION\b|\bSELECT\b)"), "Suspicious", "Normal")
| where sqli_indicators="Suspicious"
| table _time, clientip, uri_path, uri_query, status, sqli_indicators

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100774" level="12">
    <if_sid>31100</if_sid>
    <url>getbinall|getbinallagv</url>
    <regex>(\%27|\'|\-\-|\%23|\%3B|\bOR\b|\bUNION\b|\bSELECT\b)</regex>
    <description>CVE-2026-108774: JEEWMS SQL Injection attempt detected in MdBinController</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict network access to the JEEWMS web interface using firewall rules or VPN, limiting exposure to trusted networks only.
   • Enforce strong authentication and monitor for unusual login activity; ensure default credentials are changed.
   • Deploy a Web Application Firewall (WAF) with SQL injection rules, if feasible, though this is a compensating control and not a fix.
   • Disable or restrict access to the affected getbinall and getbinallagv functions if not essential, by modifying the application's routing or access controls.

2. Patch/Upgrade Steps:

   • The vendor has not released a patch. Monitor the official JEEWMS repository (e.g., GitHub) and vendor communications for updates. Since the vendor did not respond, consider engaging with the community for a fork or workaround.
   • If source code access is available, implement parameterized queries or input validation in MdBinController.java for the binstore, binid, des, and cengshu parameters as a temporary fix.

3. Long-term Hardening:

   • Adopt secure coding practices: use prepared statements (parameterized queries) for all database interactions.
   • Implement input validation and output encoding; avoid dynamic SQL construction.
   • Conduct regular security assessments and penetration testing.
   • Monitor for CVE updates and apply patches promptly when available.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-108774
2. MITRE CWE-74: https://cwe.mitre.org/data/definitions/74.html
3. JEEWMS Project Repository: https://github.com/erzhongxmu/JEEWMS (unofficial, verify vendor source)
4. OWASP SQL Injection Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
5. CISA Known Exploited Vulnerabilities Catalog (not listed as of 2026-10-27): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are currently available beyond the public exploit publication mentioned in the NVD description.