CVE-2026-108782

Executive Summary

CVE-2026-108782 is a SQL injection vulnerability (CWE-74) in erzhongxmu JEEWMS, an open-source logistics/warehouse management system, present in versions up to 2026.09.27-W39. The flaw resides in the CommonServiceImpl.getAutoList function within src/main/java/org/jeecgframework/core/common/service/impl/CommonServiceImpl.java, reachable through the Autocomplete Handler component, where the trem, searchField, and entityName arguments are not safely neutralized before being incorporated into SQL statements. A remote, authenticated attacker (CVSS 3.1 base score 6.3, vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) can manipulate these parameters to inject arbitrary SQL, and a public exploit has already been released while the vendor remains unresponsive — leaving the entire affected user base exposed with no vendor-supplied fix.

Technical Analysis

JEEWMS is built on the JEECG rapid-development framework, and the vulnerable code path sits in the framework's generic service layer. CommonServiceImpl.getAutoList is the backend method that services autocomplete suggestion requests issued by the Autocomplete Handler component of the web interface. Autocomplete widgets submit user-controlled fragment text (the search term) alongside a column selector (searchField) and a target object identifier (entityName) so the backend can build a dynamic query that filters matching records. Because the JDBC query is assembled from these three request-controlled arguments — the term (trem), the search field, and the entity name — without adequate parameterization or strict allow-listing, an attacker who can reach the autocomplete endpoint can substitute SQL metacharacters and statement fragments into any of the three arguments to alter the query's logic.

The CWE-74 classification (Improper Neutralization of Special Elements in Output Used by a Downstream Component, i.e., injection) reflects that the untrusted input crosses a trust boundary and is interpreted as code by the database engine. Two of the three vulnerable arguments are structural: entityName and searchField typically map to a table/entity and a column, so even partial control over them expands the injection surface beyond a simple string value. The trem argument is the free-text search term and is the most natural vector for classic UNION/boolean/error-based injection payloads, while searchField and entityName can enable column- and table-level manipulation where the handler does not strictly validate them against a fixed allow-list.

Attack surface: the flaw is network-reachable (AV:N) and requires only low privileges (PR:L) — the autocomplete handler is ordinarily invoked by authenticated application users, so no anonymous access is required. Exploitation has low complexity (AC:L), no user interaction (UI:N), and the CVSS scope is unchanged (S:U), with equal Low impacts to confidentiality, integrity, and availability (C:L/I:L/A:L). The combined 6.3 score places this in the Medium severity band, driven primarily by the requirement for prior authentication and the bounded single-query impact rather than by any weakness in the exploit itself.

The public disclosure notes that a working exploit "has been made available to the public," and that the upstream maintainer (erzhongxmu) was contacted but did not respond. As of this report there is no vendor patch, no fixed version, no OSV package resolution, and no tracked patch source of any kind — the patch confidence is 0/4 and the vulnerability is considered UNPATCHED. No Nuclei template, no CISA KEV entry, and no FIRST.org EPSS score currently exist for this CVE.

Exploitation Scenarios

No public proof-of-concept code was provided in the disclosure data. The following chain is described at the vulnerability-class level and does not assume specific implementation details beyond the function, file, component, and argument names given in the advisory.

1. Reconnaissance / target identification. An attacker enumerates internet-exposed JEEWMS deployments. JEEWMS is a Java web application typically served behind Tomcat/Java application servers, and instances can be located through search engines and Shodan using product/page content (e.g., http.html:"jeewms" or http.title:"jeewms"). The attacker confirms the deployment version is at or below 2026.09.27-W39, since no later fixed release exists.

2. Access to the attack surface. The Autocomplete Handler is reached through the application's normal UI/API after authentication (PR:L). The attacker needs a valid low-privileged account, which can be obtained through self-registration where enabled, default/weak credentials, or a pre-existing low-privilege foothold. No elevated role is required.

3. Triggering the injection. The attacker issues autocomplete requests that supply crafted values in the trem, searchField, and/or entityName arguments handled by CommonServiceImpl.getAutoList. Where these values are concatenated into the query used to populate suggestions, the attacker injects SQL syntax to modify the statement's structure. Because injection occurs in the query-building path rather than in a fixed single field, different payload shapes are applicable depending on which argument is under-validated: value-position payloads against trem, and column/table identifier manipulation against searchField and entityName.

4. Execution and post-exploitation impact. Successful injection allows the attacker to alter query semantics — for example, manipulating the result set, bypassing intended filters, or reaching data outside the caller's normal authorization boundary. Consistent with the CVSS impact subscores, the realistic primary outcomes are (a) unauthorized read of database contents the account should not see (C:L), (b) manipulation/modification of stored records or query results (I:L), and (c) partial disruption of the affected service through resource-heavy or malformed queries (A:L). With prior authentication already held, the injection can be used to escalate data access and pivot toward database contents held by the JEEWMS installation.

Impact Assessment

Confidentiality, integrity, and availability are each rated Low (C:L/I:L/A:L), yielding a 6.3 Medium base score with an unchanged scope (S:U). Practically, the limiting factors are the authentication requirement and the fact that a single injected query tends to affect a bounded data set rather than the entire host. The most plausible high-value use is reading sensitive operational data (orders, shipments, customer records) or altering records within the scope of the authenticated account — an insider-privilege escalation. Where the deployment reuses an over-privileged database account, impact on confidentiality and integrity could exceed the Low rating at the deployment level; CVSS 3.1 scores are computed for the default worst-case bound, so organizations should not treat 6.3 as a ceiling for their own exposure.

Blast radius: any JEEWMS instance running up to 2026.09.27-W39 that exposes the web interface and grants low-privilege accounts. Given that the flaw lives in a framework-level common service class, downstream projects forked from JEECG/erzhongxmu may share the same code pattern and thus similar exposure, though those variants are not confirmed by this advisory. Because the vendor is unresponsive and no patch exists, every affected deployment remains permanently exposed until either a third-party fix or compensating controls (WAF, network restriction, account hardening) are applied. Public exploit availability removes the "no known exploit" mitigating factor that often lowers real-world risk.

Detection Guidance

Sigma Rule

title: JEEWMS Autocomplete Handler SQL Injection Attempt (CVE-2026-108782)
id: 4a7c9f2e-1b6d-4e8a-9c3f-jee1wms001
status: experimental
description: Detects SQL injection payloads in requests to the JEEWMS Autocomplete Handler targeting the CommonServiceImpl.getAutoList arguments (trem/searchField/entityName).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108782
author: SOC Analytics
date: 2026/01/01
logsource:
  category: webserver
  product: java
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - 'trem='
      - 'searchField='
      - 'entityName='
  selection_payload:
    cs-uri-query|contains:
      - "' or "
      - '" or '
      - "' and "
      - 'union select'
      - 'sleep('
      - 'benchmark('
      - 'extractvalue('
      - 'updatexml('
      - 'concat('
      - '--'
      - '/*'
      - ';--'
  condition: selection_endpoint and selection_payload
fields:
  - c-ip
  - cs-uri-query
  - cs-uri-stem
falsepositives:
  - Legitimate search terms containing apostrophes or SQL-like keywords
level: high
tags:
  - attack.t1190
  - cve.2026.108782

YARA Rule

rule CVE_2026_108782_JEEWMS_SQLi_Request
{
    meta:
        author = "SOC Analytics"
        description = "Detects SQL injection payloads targeting JEEWMS CommonServiceImpl.getAutoList autocomplete arguments"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108782"
        cve = "CVE-2026-108782"
        date = "2026-01-01"
        severity = "high"

    strings:
        $p1 = "trem=" ascii nocase
        $p2 = "searchField=" ascii nocase
        $p3 = "entityName=" ascii nocase

        $s1 = "union select" ascii nocase
        $s2 = "or 1=1" ascii nocase
        $s3 = "' or '" ascii nocase
        $s4 = "sleep(" ascii nocase
        $s5 = "benchmark(" ascii nocase
        $s6 = "extractvalue(" ascii nocase
        $s7 = "updatexml(" ascii nocase
        $s8 = "information_schema" ascii nocase

    condition:
        any of ($p*) and any of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108782 JEEWMS Autocomplete SQL Injection Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"trem="; nocase; content:"searchField="; nocase; nocase; http.uri; pcre:"/(trem|searchField|entityName)=[^&]*(union[\s+\/*]+select|or[\s+\/*]+['\x22]?\d|sleep\(|benchmark\(|extractvalue\(|updatexml\(|information_schema)/i"; reference:cve,CVE-2026-108782; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-108782; classtype:web-application-attack; sid:2026108782; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where http.request.method == "GET" and
      (http.request.uri : "*trem=*" or http.request.uri : "*searchField=*" or http.request.uri : "*entityName=*") ]
  [ network where http.request.method == "GET" and
      (http.request.uri : "*union select*" or
       http.request.uri : "*or 1=1*" or
       http.request.uri : "*sleep(*" or
       http.request.uri : "*benchmark(*" or
       http.request.uri : "*extractvalue(*" or
       http.request.uri : "*information_schema*") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=java_web
| eval uri=coalesce(uri, cs_uri_query, url)
| where match(lower(uri),"(trem=|searchfield=|entityname=)")
| where match(lower(uri),"(union(\\+|%20)+select|or(\\+|%20)+1=1|or(\\+|%20)+'1'='1|sleep\\(|benchmark\\(|extractvalue\\(|updatexml\\(|information_schema)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as sample_uris by src_ip, dest_ip
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,appsec,sqli,">
  <rule id="108782" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>trem=|searchField=|entityName=</url>
    <regex type="pcre2">(?i)(union[\s+/\*]+select|or[\s+/\*]+['"\d]|sleep\(|benchmark\(|extractvalue\(|updatexml\(|information_schema)</regex>
    <description>CVE-2026-108782: JEEWMS autocomplete SQL injection attempt against CommonServiceImpl.getAutoList</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sqli,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). There is no vendor-supplied fix, no fixed version, and the maintainer did not respond to disclosure; the following controls are compensating measures, not a substitute for a patch.

1. Immediate mitigations

   • Place internet-facing JEEWMS instances behind a WAF or reverse proxy that inspects query parameters for SQL metacharacters, and apply virtual patching on the trem, searchField, and entityName parameters.
   • Restrict network exposure of the application and its database to trusted segments or VPN-only access; do not leave the web UI publicly reachable.
   • Enforce least-privilege database accounts for the application: revoke DDL, file, and administrative privileges, and grant only the SELECT/INSERT/UPDATE rights the application genuinely requires, limiting blast radius if injection succeeds.
   • Audit and disable self-registration or tighten account provisioning so low-privilege accounts (PR:L) are not broadly obtainable.
   • Review web and database logs for prior exploitation attempts, since a public exploit exists and abuse may already have occurred.

2. Patch / upgrade steps

   • Monitor the erzhongxmu/JEEWMS upstream repository and any JEECG framework advisories for a fix; none currently exists.
   • If/when an update is released, validate it in a staging environment and deploy promptly; confirm the affected CommonServiceImpl.getAutoList path is parameterized or the vulnerable arguments are validated against an allow-list.
   • Where feasible, apply a code-level hotfix: replace dynamic query construction in CommonServiceImpl.getAutoList with parameterized/prepared statements and strictly allow-list entityName and searchField.

3. Long-term hardening

   • Adopt parameterized queries and input allow-listing as a framework-wide standard for all generic/dynamic query builders, not just this endpoint.
   • Deploy SAST/DAST in the CI/CD pipeline to catch injection-class defects in framework-level services before release.
   • Establish a vendor/dependency monitoring process (SBOM, OSV, NVD feeds) so unresponsive upstreams do not leave deployments permanently exposed.
   • Maintain WAF rules and egress controls, and align detection content with T1190 to catch exploitation of public-facing applications.

References

• NVD — CVE-2026-108782: https://nvd.nist.gov/vuln/detail/CVE-2026-108782
• CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component: https://cwe.mitre.org/data/definitions/74.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• erzhongxmu / JEEWMS project repository (upstream, no fix published): https://github.com/erzhongxmu/JEEWMS
• CISA Known Exploited Vulnerabilities Catalog (not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note on exploit-in-the-wild evidence: the disclosure states a public exploit exists, but no named threat actor campaign, no CISA KEV listing, and no FIRST.org EPSS score are currently associated with this CVE. The upstream vendor did not respond to the disclosure, and no patch is available.