Description
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depot_flag warehouse restriction is enabled, attackers can name arbitrary warehouse ids in endpoints like /depotItem/getMaterialDepotStockByParam to read stock levels, batch numbers, sales figures and priced bill lines within the tenant.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jishenghua | jshERP | ≤ 3.6 | — |
References
- Researcher Proof of Concept exploit
- Researcher Proof of Concept exploit
- Vulnerable Code (3.6) technical-description
- Vulnerable Code (3.6) technical-description
- Vulnerable Code (3.6) technical-description
- VulnCheck Advisory: jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs third-party-advisory