Description
jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoints like /account/add, /material/add, or /material/importExcel to create settlement accounts, products with initial stock, departments and dictionary entries.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| jishenghua | jshERP | ≤ 3.6 | — |
References
- Researcher Proof of Concept exploit
- Researcher Proof of Concept exploit
- Researcher Proof of Concept exploit
- Researcher Proof of Concept exploit
- Vulnerable Code (3.6) technical-description
- Vulnerable Code (3.6) technical-description
- Vulnerable Code (3.6) technical-description
- Vulnerable Code (3.6) technical-description
- Vulnerable Code (3.6) technical-description
- Vulnerable Code (3.6) technical-description
- Vulnerable Code (3.6) technical-description
- Vulnerable Code (3.6) technical-description
- Vulnerable Code (3.6) technical-description
- Vulnerable Code (3.6) technical-description
- VulnCheck Advisory: jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints third-party-advisory