CVE-2026-108779

Executive Summary

CVE-2026-108779 is an SQL injection vulnerability in erzhongxmu JEEWMS, an open-source warehouse management system (WMS) built on Java (Spring/JPA-style stack), affecting versions up to 2026.09.27-W39. The flaw resides in the WmSttInGoodsController.list function within src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java, where manipulation of the searchstr argument allows injection of attacker-controlled SQL. Successful exploitation permits unauthorized database read/write with a remote, low-privileged authenticated vector, and no vendor patch is available at the time of writing.

Technical Analysis

JEEWMS (project namespace com.zzjee, repository owner erzhongxmu) is a Java-based warehouse management solution that exposes web controllers to handle inventory, inbound goods, and reporting operations. CVE-2026-108779 affects the list handler method of WmSttInGoodsController, which is responsible for returning a listing of inbound goods records (WmSttInGoods).

According to the NVD description, the vulnerability is triggered by manipulation of the searchstr argument passed to this controller method. The parameter is used in the construction of a database query without sufficient neutralization or parameterization, resulting in SQL injection. The CWE classification given is CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), a parent category that encompasses SQL injection as a downstream interpretation failure. In practice, this means attacker-supplied data from the searchstr request parameter reaches an SQL interpreter without adequate sanitization.

Key facts derived from the authoritative description:

• Attack vector: Network (AV:N). The controller is reachable remotely over HTTP.
• Privileges required: Low (PR:L). The description implies an authenticated or minimally-privileged context is sufficient; the raw parameter is accepted by a business-logic endpoint rather than an anonymous public page.
• User interaction: None (UI:N).
• Scope: Unchanged (S:U) — the vulnerable component and the impacted database reside in the same security authority.
• Impact: Low confidentiality, low integrity, low availability (C:L/I:L/A:L), consistent with a targeted injection into a listing/query endpoint rather than full database takeover.

Because no PoC, exploit code, or Nuclei template is present in tracked sources, specific payload structure, injection point depth (e.g., string concatenation vs. dynamic query builder), and database backend (MySQL/MariaDB/PostgreSQL) cannot be confirmed from the supplied data. The attack mechanism is therefore described strictly at the vulnerability-class level: injection of SQL syntax via the searchstr request parameter to alter query semantics. The description states the exploit is publicly available and may be used; however, no exploit artifact could be verified within this dataset, so this should be treated as an unconfirmed public-availability claim from the disclosure.

Exploitation Scenarios

The following chain is inferred strictly from the vulnerability class and the NVD description. No public PoC is available; attack specifics beyond the named function, file, and parameter are not asserted.

1. Reconnaissance / target identification. An attacker identifies an internet- or intranet-exposed JEEWMS deployment. The target surface is the inbound-goods listing endpoint mapped to WmSttInGoodsController.list. Fingerprinting is possible through product-specific page titles, static asset paths, or default login interfaces typical of the JEEWMS web application.

2. Triggering the flaw class. The attacker issues an HTTP request to the list action of WmSttInGoodsController supplying a crafted value in the searchstr parameter. Because the parameter flows into a SQL query without proper parameterization, the injected SQL is interpreted by the database. This is a classic second-order-first-order SQL injection: the request parameter is the injection vector, and the SQL engine is the downstream interpreter.

3. Payload / execution method (class level). At the vulnerability-class level, an attacker manipulates searchstr with SQL syntax that alters the WHERE/selection logic of the underlying listing query — for example, boolean conditions, UNION-style result set extension, or error/stacked subquery constructs — subject to the capabilities of the database backend. The attacker does not need special tooling; a standard HTTP client and SQL injection technique suffice. Because PR:L applies, some access context (a low-privileged authenticated session or a minimally-restricted endpoint) is assumed to be sufficient to reach the handler.

4. Post-exploitation impact. With successful injection, the attacker can read data beyond the intended listing scope (confidentiality impact), modify records within reach of the application's database account (integrity impact), and potentially induce database locking or denial of the listing service (availability impact). The CVSS scope is Unchanged, so the compromise is contained within the application/database trust boundary rather than pivoting to unrelated components via this vector alone. Given C:L/I:L/A:L, the primary value to an attacker is targeted data exfiltration or selective record manipulation rather than wholesale database destruction.

No evidence of weaponization, exploit-kit integration, or in-the-wild observation was found in the supplied data, and no threat actor attribution can be made.

Impact Assessment

• Business impact: A warehouse management system stores operational data — inbound/outbound goods, inventory levels, suppliers, and internal inventory movement records. SQL injection in a listing controller can expose this data to unauthorized parties, corrupt inventory records, or disrupt warehouse operations through denial-of-service effects on listing queries.
• Affected systems: Deployments of erzhongxmu JEEWMS up to and including version 2026.09.27-W39 that expose the WmSttInGoodsController endpoints over a network.
• Blast radius: Bounded by the privileges of the database account used by the application. Because CVSS scope is Unchanged (S:U), the vulnerability does not intrinsically escalate to full host compromise; however, data integrity and confidentiality within the WMS database are directly at risk.
• CVSS interpretation (6.3, Medium): AV:N — remotely exploitable; AC:L — no complex preconditions; PR:L — low privileges required; UI:N — no victim interaction; S:U — contained scope; C:L/I:L/A:L — partial impact across all three security objectives.
• Patch status: UNPATCHED (0/4 confidence). The vendor was contacted and did not respond, leaving a persistent exposure window. Combined with a public-availability claim for the exploit, this elevates operational urgency despite the Medium severity score.
• EPSS: Not yet scored by FIRST.org; no exploit-probability metric is available to refine prioritization.

Detection Guidance

Sigma Rule

title: JEEWMS WmSttInGoodsController searchstr SQL Injection Attempt
id: 3f6c2b1a-7d4e-4a91-9c2e-8b1f5d7a4e10
status: experimental
description: Detects SQL injection patterns in the searchstr parameter targeting the JEEWMS WmSttInGoodsController.list endpoint (CVE-2026-108779).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108779
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - 'WmSttInGoodsController'
      - 'wm/wmSttInGoods'
  selection_payload:
    cs-uri-query|contains:
      - 'searchstr='
    cs-uri-query|re:
      - "(?i)(searchstr=.*(\\%27|'|--|%23|#|union|select|sleep\\(|benchmark\\(|extractvalue|updatexml|or\\s+1=1|and\\s+1=1))"
  condition: selection_endpoint and selection_payload
fields:
  - c-ip
  - cs-uri-query
  - cs-method
falsepositives:
  - Legitimate search strings containing SQL-like keywords
  - Security scanners performing authorized testing
level: high

YARA Rule

rule CVE_2026_108779_JEEWMS_SQLi_Request
{
    meta:
        description = "Detects HTTP requests attempting SQL injection against JEEWMS WmSttInGoodsController.list searchstr parameter (CVE-2026-108779)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108779"
        date = "2026-01-01"
        severity = "high"

    strings:
        $endpoint1 = "WmSttInGoodsController" ascii nocase
        $endpoint2 = "wmSttInGoods" ascii nocase
        $param = "searchstr=" ascii nocase
        $sqli1 = "union" ascii nocase
        $sqli2 = "select" ascii nocase
        $sqli3 = "sleep(" ascii nocase
        $sqli4 = "benchmark(" ascii nocase
        $sqli5 = "extractvalue" ascii nocase
        $sqli6 = "updatexml" ascii nocase
        $quote = "'" ascii
        $comment = "--" ascii

    condition:
        ($endpoint1 or $endpoint2) and $param and
        (2 of ($sqli*) or $quote or $comment)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108779 JEEWMS WmSttInGoodsController searchstr SQL Injection Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"WmSttInGoodsController"; http.uri; content:"searchstr"; pcre:"/searchstr=[^&]*(%27|'|--|%23|union|select|sleep\(|benchmark\()/Ui"; classtype:web-application-attack; reference:cve,CVE-2026-108779; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-108779; sid:2026108779; rev:1; metadata:created_at 2026_01_01, confidence High;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method == "GET" and
    stringContains(url.query, "searchstr") and
    (stringContains(url.query, "union") or
     stringContains(url.query, "select") or
     stringContains(url.query, "sleep(") or
     stringContains(url.query, "benchmark(") or
     stringContains(url.query, "%27") or
     stringContains(url.query, "--"))]
  [http where url.path : "*WmSttInGoods*"]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access
| eval uq=urldecode(uri_query)
| where match(uq, "(?i)searchstr") AND (match(uq, "(?i)(%27|'|--|union|select\\s|sleep\\(|benchmark\\(|extractvalue|updatexml|or\\s+1=1)"))
  OR match(uri_path, "(?i)WmSttInGoodsController")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_query) as payloads by src_ip, uri_path, uri_query
| where count > 0
| sort - count
| table first_seen, last_seen, src_ip, uri_path, uri_query, count

Wazuh OSSEC Rule

<group name="web,appsec,jeewms,">
  <rule id="310877" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>WmSttInGoodsController</url>
    <regex type="pcre2">(?i)searchstr=[^&]*(%27|'|--|%23|union|select|sleep\(|benchmark\(|extractvalue|updatexml)</regex>
    <description>CVE-2026-108779: JEEWMS WmSttInGoodsController searchstr SQL injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="310878" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>WmSttInGoodsController</url>
    <regex type="pcre2">(?i)searchstr</regex>
    <description>JEEWMS WmSttInGoodsController listing accessed with searchstr parameter - monitor for abuse</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED) — no patch evidence from any tracked source. The vendor was contacted and did not respond, so no official fix, workaround, or fixed version is available.

1. Immediate mitigations

   • Restrict network access to JEEWMS web endpoints. Place the application behind a reverse proxy or VPN and block direct internet exposure of the application port where feasible.
   • Enforce authentication and least-privilege access to the inbound-goods listing functionality; because PR:L applies, limiting who can reach the controller reduces the exploitable population.
   • Deploy a WAF with SQL injection rules (virtual patching) to filter malicious searchstr payloads targeting WmSttInGoodsController before they reach the application. Treat WAF as a compensating control, not a fix.
   • Monitor and alert on searchstr request patterns as described in the Detection Guidance section.
   • Restrict the database account used by the application to the minimum privileges required for normal operation (no DDL, no unnecessary cross-schema access) to reduce injection impact.

2. Patch / upgrade steps

   • No vendor patch is available. Monitor the JEEWMS project (erzhongxmu/JEEWMS) for a security fix and apply it as soon as it is published.
   • If the codebase is available, remediate at source: replace dynamic SQL construction in WmSttInGoodsController.list that consumes the searchstr argument with parameterized queries or prepared statements. As an interim code-level control, apply strict allow-list validation on searchstr.
   • Conduct a broader review of other controller methods that accept free-form search parameters (*Controller list handlers), as the same pattern may recur elsewhere.

3. Long-term hardening

   • Adopt secure coding standards requiring parameterized queries for all database access across the application.
   • Implement static application security testing (SAST) in the CI/CD pipeline to catch SQL injection patterns before deployment, given the open-source, self-hosted nature of JEEWMS.
   • Maintain an inventory of self-hosted WMS deployments and track upstream CVEs; because CISA KEV does not list this vulnerability, there is no federal remediation deadline, so internal SLAs must drive response.
   • Segment the WMS database from general corporate networks and log all anomalous query activity.

References

• NVD — CVE-2026-108779: https://nvd.nist.gov/vuln/detail/CVE-2026-108779
• MITRE CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'): https://cwe.mitre.org/data/definitions/74.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• erzhongxmu/JEEWMS source repository (project namespace com.zzjee): https://github.com/erzhongxmu/JEEWMS
• FIRST EPSS (no score available at time of writing): https://www.first.org/epss
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-108779 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No confirmed threat actor campaigns, exploit-in-the-wild observations, or exploit artifacts were identified in the supplied data for CVE-2026-108779. The disclosure states an exploit is publicly available and may be used; this claim could not be independently verified within this dataset.