Executive brief
jshERP, an open-source Enterprise Resource Planning (ERP) system used for business management, contains a security flaw that allows unauthorized individuals to reset user passwords. By exploiting this vulnerability, an attacker can gain full access to any user account, potentially leading to the theft of sensitive financial, inventory, and corporate data. This could result in significant operational disruption and unauthorized access to business-critical information.
Technical details
An improper access control vulnerability exists in the resetPwd method within the UserController.java component of jshERP v3.5. The flaw allows an attacker to bypass authentication requirements by using path traversal techniques (e.g., /user/login/../resetPwd) and removing the X-Access-Token header from the request. By modifying the 'id' value in the JSON parameters of the password reset request, a remote, unauthenticated attacker can reset the password of any user account to a default value. This leads to complete account takeover and horizontal privilege escalation across the ERP platform.
Affected products
- jishenghua jshERP 3.5
Timeline
- 2025-08-21: disclosed: Initial disclosure of the vulnerability
- 2025-08-21: advisory: NVD published the CVE record