CVE-2026-108777

Executive Summary

CVE-2026-108777 is a SQL injection vulnerability in erzhongxmu JEEWMS, an open-source warehouse management system, affecting versions up to 2026.09.27-W39. The flaw resides in the WvGiController.list function within src/main/java/com/zzjee/wmapi/controller/WvGiController.java, where the searchstr argument is not properly sanitized before being incorporated into a SQL query. The vulnerability carries a CVSS v3.1 base score of 6.3 (Medium severity), is remotely exploitable by an authenticated low-privileged user, and a public exploit has been released while the vendor remains unresponsive and no patch exists.

Technical Analysis

The vulnerability is a classic SQL injection (CWE-89) arising from improper neutralization of special elements used in a SQL command. According to the NVD description, the affected component is the list function of the WvGiController class in the JEEWMS wmapi module (src/main/java/com/zzjee/wmapi/controller/WvGiController.java). The searchstr argument, likely passed as an HTTP request parameter to a listing or search endpoint, is concatenated or interpolated directly into a SQL query without adequate parameterization or input validation.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L indicates:

• Attack Vector (Network): exploitable remotely over the network.
• Attack Complexity (Low): no special conditions or race conditions required.
• Privileges Required (Low): the attacker must possess a valid low-privileged account, likely a standard application user. This suggests the vulnerable endpoint requires some form of authentication but not administrative rights.
• User Interaction (None): no victim action is needed.
• Scope (Unchanged): the exploit does not affect components beyond the vulnerable application.
• Confidentiality, Integrity, Availability (Low each): partial impact in all three areas, consistent with the ability to read arbitrary data, modify query results or database contents, and potentially cause limited denial of service.

Because the flaw is reachable through the wmapi module, it is embedded in an API endpoint exposed by the warehouse management application. The lack of input sanitization on searchstr allows an attacker to inject SQL syntax that alters the intended query, enabling unauthorized data retrieval or manipulation. The public disclosure of an exploit increases the likelihood of opportunistic scanning and exploitation.

No further technical details (e.g., exact query structure, database engine) are provided in the NVD description; the analysis above is derived solely from the disclosed information and the vulnerability class.

Exploitation Scenarios

Given the available data, the following attack chain is inferred from the vulnerability class and the disclosed vector. No public PoC code is included in this report; the steps describe the exploitation methodology at the vulnerability-class level.

1. Reconnaissance and Target Identification: An attacker identifies internet-facing JEEWMS instances. This may be achieved through Shodan queries for JEEWMS-specific HTTP titles or HTML content, or by scanning for the known wmapi API endpoints. The attacker must also obtain or already possess low-privileged credentials, as the CVSS vector indicates PR:L. Credentials could be obtained through default accounts, credential stuffing, or prior phishing.

2. Triggering the Flaw: The attacker sends a crafted HTTP request to the endpoint that invokes the WvGiController.list function. The searchstr argument is manipulated to include SQL metacharacters (e.g., single quote, boolean operators, UNION SELECT). Because the application fails to sanitize this argument, the injected SQL is executed by the backend database.

3. Payload Execution (Vulnerability-Class Level): The attacker leverages standard SQL injection techniques to alter the logic of the underlying query. This could allow bypassing filters, extracting data from arbitrary tables (e.g., user credentials, warehouse inventory, order details), or modifying database records. The exact payload syntax depends on the database engine in use, which is not specified in the available intelligence.

4. Post-Exploitation Impact: Successful exploitation can lead to unauthorized access to sensitive business data (confidentiality impact), manipulation of inventory or shipment records (integrity impact), and potential disruption of warehouse operations through destructive SQL statements or resource exhaustion (availability impact). The "Low" ratings for C/I/A suggest limited but non-negligible damage per exploit; however, repeated exploitation could escalate the overall impact on the organization.

The existence of a public exploit significantly lowers the barrier to entry, making this vulnerability attractive to both sophisticated actors and script-based attackers.

Impact Assessment

The business impact of CVE-2026-108777 is concentrated in organizations that deploy JEEWMS for warehouse and inventory management. Because the wmapi module is likely used for integration with mobile scanners, ERP systems, or third-party logistics platforms, a SQL injection here can expose critical operational data and undermine trust in the integrity of inventory records.

The CVSS v3.1 base score of 6.3 reflects a medium severity, driven by the network attack vector, low attack complexity, and low privileges required. The partial impacts to confidentiality, integrity, and availability mean that a single exploit might not be catastrophic, but the public availability of an exploit and the lack of a patch elevate the risk for unmitigated deployments. An attacker could:

• Enumerate database schema and extract sensitive information such as user password hashes, customer details, and proprietary inventory levels.
• Modify or delete records, leading to operational errors, financial loss, or compliance violations.
• Cause limited service disruption by injecting heavy queries or locking tables.

The blast radius extends to any system integrated with the JEEWMS instance, as compromised data integrity can propagate to downstream planning, billing, and reporting systems. Given the vendor's non-responsiveness, the exposure window is indefinite, making risk-based prioritization essential for defenders.

Detection Guidance

Sigma Rule

title: JEEWMS WvGiController SQL Injection Attempt
id: 5f2a1b3c-9d4e-4f6a-8b7c-1e2d3f4a5b6c
status: experimental
description: Detects SQL injection attempts targeting the WvGiController.list function via the searchstr parameter in JEEWMS.
author: Threat Intelligence Team
date: 2026/10/27
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108777
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection:
    cs-uri-query|contains:
      - 'searchstr='
      - 'searchstr%3D'
  keywords:
    - "' OR '"
    - "' UNION SELECT"
    - "' AND SLEEP"
    - "' WAITFOR DELAY"
    - "' OR 1=1--"
    - "') OR ('"
    - "searchstr=*'*"
  condition: selection and keywords
fields:
  - clientip
  - cs-uri-stem
  - cs-uri-query
  - cs-method
falsepositives:
  - Legitimate search strings containing apostrophes
  - Security scanners with non-malicious payloads
level: high
tags:
  - attack.t1190
  - cve.2026.108777

YARA Rule

rule CVE_2026_108777_JEEWMS_SQLi
{
    meta:
        description = "Detects SQL injection payloads targeting JEEWMS WvGiController searchstr parameter"
        author = "Threat Intelligence Team"
        date = "2026-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108777"
        severity = "high"

    strings:
        $s1 = "searchstr=" ascii wide nocase
        $s2 = "WvGiController" ascii wide nocase
        $sqli1 = "' OR '" ascii wide nocase
        $sqli2 = "' UNION SELECT" ascii wide nocase
        $sqli3 = "' AND SLEEP" ascii wide nocase
        $sqli4 = "' WAITFOR DELAY" ascii wide nocase
        $sqli5 = "' OR 1=1--" ascii wide nocase

    condition:
        ($s1 or $s2) and any of ($sqli*)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-108777 JEEWMS WvGiController SQL Injection Attempt"; flow:to_server,established; content:"searchstr="; http_uri; nocase; pcre:"/searchstr=[^&]*(%27|'|\x27).*(OR|UNION|SELECT|SLEEP|WAITFOR|AND)/Ui"; reference:cve,2026-108777; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-108777; classtype:web-application-attack; sid:2026108777; rev:1; metadata:created_at 2026_10_27, updated_at 2026_10_27, mitre_tactic_id T1190;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [network where network.protocol == "http" and
   url.query contains "searchstr=" and
   (url.query contains "' OR '" or
    url.query contains "' UNION SELECT" or
    url.query contains "' AND SLEEP" or
    url.query contains "' WAITFOR DELAY" or
    url.query contains "' OR 1=1--")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=apache_access
| where match(url, "(?i)searchstr\s*=\s*[^&]*(\%27|'|\x27)\s*(OR|UNION|SELECT|SLEEP|WAITFOR|AND)")
| eval sqli_payload = mvindex(split(url, "searchstr="), 1)
| table _time, clientip, method, url, status, sqli_payload
| sort -_time

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="110877" level="12">
    <if_sid>31100</if_sid>
    <field name="url">searchstr=</field>
    <regex type="pcre2">(?i)searchstr\s*=\s*[^&]*(\%27|'|\x27)\s*(OR|UNION|SELECT|SLEEP|WAITFOR|AND)</regex>
    <description>CVE-2026-108777: JEEWMS WvGiController SQL injection attempt detected via searchstr parameter.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

The vendor was contacted early about this disclosure but did not respond, and no official patch, workaround, or updated version has been published. Organizations running JEEWMS are advised to take the following actions:

1. Immediate Mitigations:

   • Restrict network access to the JEEWMS wmapi endpoints using firewall rules, VPNs, or zero-trust network policies. Limit exposure to trusted internal networks only.
   • Enforce strong authentication and the principle of least privilege for all JEEWMS accounts. Disable or rename default accounts if present.
   • Deploy a Web Application Firewall (WAF) with virtual patching rules specifically targeting SQL injection in the searchstr parameter. Note: WAFs are a compensating control, not a fix.
   • Monitor logs for anomalous requests to WvGiController.list and for SQL injection patterns in searchstr.

2. Patch/Upgrade Steps:

   • No vendor patch is available. Continuously monitor the JEEWMS GitHub repository, NVD, and vendor channels for updates. Since the project is open-source, consider contributing a fix (e.g., using parameterized queries in WvGiController.java) if organizational policy allows.
   • If a patched version is released, test it in a staging environment before applying to production.

3. Long-Term Hardening:

   • Conduct a code review of the JEEWMS codebase, focusing on all input-handling routines, and remediate any other instances of string concatenation in SQL queries.
   • Implement secure coding training for developers, emphasizing parameterized queries and input validation.
   • Adopt a vulnerability management program that includes third-party component inventory and regular dependency scanning.
   • Consider migrating to a supported warehouse management platform if the vendor remains unresponsive and unpatched vulnerabilities accumulate.

References

1. National Vulnerability Database: https://nvd.nist.gov/vuln/detail/CVE-2026-108777
2. CWE-89: Improper Neutralization of Special Elements used in an SQL Command: https://cwe.mitre.org/data/definitions/89.html
3. JEEWMS GitHub Repository (erzhongxmu/JEEWMS): https://github.com/erzhongxmu/JEEWMS
4. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. CISA Known Exploited Vulnerabilities Catalog (not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence beyond the public exploit disclosure have been reported. The vulnerability is not included in CISA KEV.