CVE-2026-108775

Executive Summary

CVE-2026-108775 is a SQL injection vulnerability in JEEWMS (erzhongxmu JEEWMS up to version 2026.09.27-W39), specifically in the WvNoticeController.list function within com/zzjee/wmapi/controller/WvNoticeController.java. The flaw is triggered through manipulation of the searchstr argument handled by a search endpoint and is remotely exploitable by an authenticated, low-privileged user. The vendor was notified but never responded; no patch exists, and although NVD notes the exploit has been disclosed publicly, no concrete PoC payload is present in the tracked sources.

Technical Analysis

JEEWMS is an open-source Java-based warehouse management system built on a Spring/JPA-style MVC architecture. CVE-2026-108775 resides in the controller class com/zzjee/wmapi/controller/WvNoticeController.java, in the list function. The list endpoint accepts a searchstr parameter — an application-level search filter string — which is passed into a database query without adequate parameterization or input sanitization. The result is SQL injection (CWE-74, improper neutralization of special elements used in a command).

Key technical attributes derivable from the description:

• Attack surface: A network-accessible search endpoint exposed by a web application (AV:N).
• Injection point: The searchstr argument of WvNoticeController.list.
• Privilege requirement: The CVSS vector includes PR:L (low privileges), indicating the endpoint is reachable by an authenticated, low-privileged user — the flaw does not by itself grant unauthenticated access.
• Complexity: AC:L — no special conditions or race window required.
• Impact: C:L/I:L/A:L — limited confidentiality, integrity, and availability impact, consistent with an injection that weakens query logic, allows reading portions of the backing database, or causing limited data manipulation/query disruption.

Because the description does not specify the exact query construction (string concatenation vs. dynamic query building), the precise injection payload syntax cannot be confirmed. What is confirmable is the vulnerability class: user-supplied input in searchstr reaches a SQL statement without proper escaping or binding, allowing an attacker to alter query semantics.

Exploitation Scenarios

No public PoC payload is available in the provided data, so the following attack chain is described strictly at the vulnerability-class level.

1. Reconnaissance / Target Identification. An attacker locates an internet- or intranet-exposed JEEWMS instance (e.g., via Shodan dorks targeting the product, login pages, or JEEWMS-specific HTML). The attacker identifies the wmapi search endpoints, including notice search functionality backed by WvNoticeController.

2. Authentication and Endpoint Discovery. Because the vulnerability requires low privileges (PR:L), the attacker obtains valid low-privileged credentials (via default credentials, credential stuffing, or a separate foothold) and maps the search endpoint that maps to WvNoticeController.list. The attacker identifies the searchstr request parameter.

3. Triggering the Flaw (SQL Injection via searchstr). The attacker supplies a crafted searchstr value designed to break out of the intended search clause and inject additional SQL syntax — for example, boolean-based or UNION-style constructs at the class level. The application concatenates this value into a backend query, so the injected syntax is interpreted by the database rather than treated as literal search text. Because AC:L, no timing or environmental priors are required.

4. Post-Exploitation Impact. Successful injection enables the attacker to read data from the backing database (e.g., warehouse, order, notice, and user tables), manipulate query results or data (I:L), or degrade query performance (A:L). Any credentials or business data retrievable from the database expand the blast radius into lateral movement and further account compromise.

Impact Assessment

CVSS v3.1 base score: 6.3 (Medium) — AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

• Confidentiality (Low): Database contents reachable through the vulnerable query may be exposed.
• Integrity (Low): Injection may allow modification of query logic and, depending on privileges, limited data tampering.
• Availability (Low): Malicious queries could disrupt the affected search function or degrade database performance.
• Scope: Unchanged — impact remains within the JEEWMS application and its database.
• Exploitability: Network-reachable, low complexity, low privileges, no user interaction — attractive to opportunistic attackers once endpoint details are known.
• Blast radius: Any deployment of JEEWMS at or below 2026.09.27-W39 that exposes the wmapi search endpoints. Because no patch exists and the vendor is unresponsive, exposed instances remain at risk indefinitely.

Detection Guidance

Sigma Rule

title: JEEWMS WvNoticeController searchstr SQL Injection Attempt
id: 9f2a1c7e-4b3d-4e21-9a55-7c1d9e0b6a12
status: experimental
description: Detects SQL injection attempts against the JEEWMS wmapi notice search endpoint (CVE-2026-108775).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108775
author: valtersit.com
date: 2026/09/27
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-query|contains:
      - 'searchstr='
  selection_payload:
    cs-uri-query|contains:
      - "' or "
      - "' OR "
      - " or 1=1"
      - " union select"
      - " UNION SELECT"
      - "--"
      - "sleep("
      - "benchmark("
  condition: selection_uri and selection_payload
falsepositives:
  - Legitimate searches containing SQL keywords or quotes
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.108775

YARA Rule

rule CVE_2026_108775_JEEWMS_SQLi
{
    meta:
        description = "Detects SQL injection payloads targeting JEEWMS WvNoticeController searchstr parameter"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108775"
        date = "2026-09-27"
        cve = "CVE-2026-108775"

    strings:
        $uri = "WvNoticeController"
        $p1  = "searchstr=" nocase
        $sq1 = "' or " nocase
        $sq2 = " union select" nocase
        $sq3 = "sleep(" nocase
        $sq4 = "benchmark(" nocase

    condition:
        any of ($uri, $p1) and any of ($sq*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108775 JEEWMS searchstr SQL Injection Attempt"; flow:established,to_server; http.uri; content:"searchstr="; nocase; http.uri; pcre:"/(\%27|\x27)\s*(or|OR)\s|union\s+select|sleep\(|benchmark\(/"; reference:cve,2026-108775; classtype:web-application-attack; sid:2026108775; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "GET" and
      http.request.uri : ("*WvNoticeController*" or "*searchstr=*") ]
  [ network where http.request.uri :
      ("*searchstr=*' or*" or "*searchstr=* union select*" or
       "*searchstr=*sleep(*" or "*searchstr=*benchmark(*") ]

Splunk SPL Query

index=web OR index=proxy
| eval uri=coalesce(uri, url, cs_uri_query, http_request_uri)
| where match(uri, "(?i)(WvNoticeController|searchstr=)")
| where match(uri, "(?i)(' or |union\\s+select|sleep\\(|benchmark\\(|-- )")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,jeewms,">
  <rule id="2026108775" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>WvNoticeController</match>
    <regex type="pcre2">(?i)searchstr=.*(%27|')\s*(or|union\s+select)|searchstr=.*(?i)(sleep\(|benchmark\()</regex>
    <description>CVE-2026-108775: JEEWMS WvNoticeController searchstr SQL injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,cve_2026_108775,sql_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict network access to JEEWMS wmapi search endpoints — do not expose them to untrusted networks; place them behind VPN, allow-listing, or a WAF.
   • Enforce strong authentication and least-privilege roles so that low-privileged accounts cannot reach administrative search functions.
   • Deploy virtual patching (WAF rules) that inspect the searchstr parameter for SQL metacharacters and known injection patterns. Because the vendor did not respond, virtual patching is the primary near-term control.

2. Patch / upgrade steps

   • No official patch or fixed version is available; the vendor was contacted and did not respond. Monitor the JEEWMS project repository and erzhongxmu release channels for an updated version above 2026.09.27-W39.
   • If source code is available, apply input validation and use parameterized queries (prepared statements) in WvNoticeController.list for the searchstr argument as an interim code fix.

3. Long-term hardening

   • Adopt parameterized queries/ORM bindings across all wmapi controllers to eliminate string-concatenated SQL.
   • Enforce allow-list validation on search parameters (length, character class, expected patterns).
   • Run the backing database account under least privilege to limit exploitation impact (read-only where possible).
   • Add continuous detection for injection attempts (rule set above) and regularly review access logs for searchstr anomalies.
   • Maintain an SBOM and watch OSV/NVD feeds for JEEWMS advisories; because no patch exists, treat all deployments <= 2026.09.27-W39 as exposed.

References

• NVD — CVE-2026-108775: https://nvd.nist.gov/vuln/detail/CVE-2026-108775
• MITRE CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component — "Injection"): https://cwe.mitre.org/data/definitions/74.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS — not yet scored for this CVE (no EPSS value available at time of writing)
• CISA KEV — this CVE is NOT currently listed in the Known Exploited Vulnerabilities catalog.
• Vendor: erzhongxmu JEEWMS — no advisory published; vendor did not respond to disclosure.