Executive brief
JeeWMS, a warehouse management system, contains a security flaw in its database connection testing feature. An unauthenticated attacker can exploit this to remotely execute commands on the server. This could lead to a complete takeover of the system, unauthorized access to inventory data, and disruption of warehouse operations.
Technical details
The vulnerability exists in the JimuReport test-connection endpoint (/base-boot/jmreport/testConnection) of JeeWMS. The endpoint is explicitly configured for anonymous access in ShiroConfig and accepts attacker-controlled JDBC parameters (dbType, dbDriver, dbUrl, etc.). By supplying a malicious PostgreSQL JDBC URL with 'socketFactory' and 'socketFactoryArg' parameters, an attacker can trigger arbitrary class instantiation. In specific environments, this allows loading a remote Spring XML configuration file to achieve Remote Code Execution (RCE). The vulnerability is present in versions up to commit 141740afb2ba14d441c82a833d0a418d07ca2d69.
Affected products
- erzhongxmu JeeWMS up to 141740afb2ba14d441c82a833d0a418d07ca2d69
Timeline
- 2026-05-13: disclosed: Initial public disclosure on GitHub issues
- 2026-06-07: advisory: NVD/VulDB publication