CVE-2026-108781

Executive Summary

CVE-2026-108781 is a SQL injection vulnerability in the JEEWMS warehouse management system, specifically within the WmToMoveGoodsController.list function of the PDA interface. An authenticated remote attacker can manipulate the searchstr argument to inject arbitrary SQL, potentially leading to data exposure, data manipulation, or further compromise of the backend database. The vendor has not responded to disclosure attempts, and no official patch exists, leaving all deployments up to version 2026.09.27-W39 at risk.

Technical Analysis

JEEWMS is a Java-based open-source warehouse management system built on the Spring MVC framework. The vulnerability resides in src/main/java/com/zzjee/wm/controller/WmToMoveGoodsController.java, specifically in the list method. This method handles HTTP requests from the PDA (Personal Digital Assistant) interface, which is used by warehouse staff for mobile inventory operations.

The flaw is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, i.e., Injection). The searchstr parameter is passed to the backend without adequate sanitization, allowing an attacker to inject SQL statements. Given the CVSS vector (AV:N/AC:L/PR:L/UI:N), the attack is network-accessible, requires low complexity, and needs low-level privileges (likely an authenticated PDA user). The impact is partial confidentiality, integrity, and availability loss (C:L/I:L/A:L), indicating that while the injection can read or modify data, it may not grant full database control in a single request. However, chained attacks could escalate.

The vulnerable endpoint is part of the PDA interface, which is often exposed on internal networks or VPNs, but may also be internet-facing in misconfigured deployments. The lack of a vendor patch or workaround increases the severity for organizations relying on this software.

Exploitation Scenarios

1. Reconnaissance: An attacker identifies a JEEWMS instance via Shodan dorks (e.g., http.html:"JEEWMS"). The PDA interface is typically accessible at a path like /wm/toMoveGoods/list or similar, though the exact endpoint is not specified in the description.
2. Authentication: The attacker needs valid credentials (PR:L). These may be obtained through default accounts, credential stuffing, or social engineering. Once authenticated, the attacker accesses the PDA interface.
3. Triggering the Flaw: The attacker sends a crafted HTTP request to the list method, injecting SQL payloads into the searchstr parameter. For example, a request might look like: GET /wm/toMoveGoods/list?searchstr=1' UNION SELECT ... --. The application fails to sanitize the input, executing the injected SQL against the backend database.
4. Post-Exploitation: Depending on database privileges, the attacker can extract sensitive data (e.g., user credentials, inventory records), modify or delete data, or potentially execute stored procedures to escalate privileges or pivot to other systems. The CVSS impact (C:L/I:L/A:L) suggests limited but tangible damage.

No public PoC or exploit code is provided, but the vulnerability class is well-understood. Attackers may automate injection using tools like sqlmap once the endpoint and parameter are known.

Impact Assessment

The CVSS score of 6.3 (Medium) reflects partial loss of confidentiality, integrity, and availability. Business impact includes:

• Data Breach: Exposure of warehouse inventory, customer orders, and user credentials.
• Operational Disruption: Manipulation of stock levels or order statuses could disrupt supply chain operations.
• Reputation Damage: Loss of customer trust and potential regulatory fines (e.g., GDPR, HIPAA).
• Blast Radius: All JEEWMS deployments up to version 2026.09.27-W39 are affected. The PDA interface is often used on internal networks, but if exposed to the internet, the attack surface widens. The lack of vendor response means no official fix is imminent, prolonging risk.

Detection Guidance

Sigma Rule

title: JEEWMS SQL Injection Attempt in WmToMoveGoodsController
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts against the searchstr parameter in JEEWMS PDA interface.
author: Threat Intelligence Team
logsource:
  category: webserver
  product: java
detection:
  selection:
    cs-method: 'GET'
    cs-uri-query|contains: 'searchstr='
    cs-uri-query|contains:
      - "'"
      - '"'
      - '--'
      - ';'
      - '/*'
      - '*/'
      - 'union'
      - 'select'
      - 'insert'
      - 'update'
      - 'delete'
      - 'drop'
  condition: selection
falsepositives:
  - Legitimate use of special characters in search strings
level: high

YARA Rule

rule CVE_2026_108781_JEEWMS_SQLi
{
    meta:
        description = "Detects SQL injection patterns in HTTP requests targeting JEEWMS WmToMoveGoodsController"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "CVE-2026-108781"
    strings:
        $s1 = "searchstr=" ascii wide nocase
        $s2 = "WmToMoveGoodsController" ascii wide nocase
        $sqli1 = "'" ascii
        $sqli2 = "--" ascii
        $sqli3 = "union" ascii nocase
        $sqli4 = "select" ascii nocase
        $sqli5 = "or 1=1" ascii nocase
    condition:
        any of ($s1, $s2) and any of ($sqli*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108781 JEEWMS SQL Injection Attempt"; flow:to_server,established; content:"searchstr="; http_uri; content:"'"; http_uri; content:"union"; http_uri; nocase; content:"select"; http_uri; nocase; pcre:"/searchstr=[^&]*('|--|union|select|insert|update|delete|drop)/i"; reference:cve,2026-108781; classtype:web-application-attack; sid:1000001; rev:1;)

Elastic Detection

sequence by process.entity_id
  [network where http.request.method == "GET" and url.query contains "searchstr="]
  [network where url.query regex ".*(union|select|insert|update|delete|drop|--|;|'|\").*"]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri="*searchstr=*"
| regex uri="(?i)(union|select|insert|update|delete|drop|--|;|'|\")"
| stats count by src_ip, uri, status
| where count > 5

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="100001" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>searchstr=</match>
    <regex>(?i)(union|select|insert|update|delete|drop|--|;|'|\")</regex>
    <description>CVE-2026-108781: JEEWMS SQL Injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Implement input validation and parameterized queries for the searchstr parameter if custom code modification is feasible.
   • Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns targeting the searchstr parameter.
   • Restrict access to the PDA interface to trusted IP ranges or VPN only.
   • Monitor logs for suspicious searchstr payloads and alert on injection attempts.

2. Patch/Upgrade Steps:

   • No official patch is available. Contact the vendor (erzhongxmu) for updates; consider migrating to an alternative WMS if no response.
   • If using a fork or community version, apply custom patches based on secure coding practices (e.g., PreparedStatement).

3. Long-Term Hardening:

   • Conduct a security audit of all JEEWMS components, especially PDA interfaces.
   • Implement least-privilege database accounts for the application.
   • Regularly update and patch third-party dependencies.
   • Adopt secure development lifecycle (SDL) practices for any in-house modifications.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-108781
• CWE-74: https://cwe.mitre.org/data/definitions/74.html
• JEEWMS Project: https://github.com/erzhongxmu/JEEWMS (vendor repository)
• MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/
• No known threat actor campaigns or exploit-in-the-wild evidence beyond the public disclosure of the vulnerability.